topic Re: Repeating control in form? in Splunk Search

Repeating control in form?

wwhitener — Mon, 23 Jan 2012 22:13:53 GMT

Hey all,

I was poking around doing a custom form and, since there are no checkbox controls that I can find, came up with the idea of using a repeating dropdown. I have a list of terms that may or may not be in the events I am searching--Term1, Term2, Term3.

I was thinking something like the following:

Term1 |{v} Yes |

Term2 |{v} No |

Term3 |{v} Maybe |

Term1's value would be " AND mytag=Term1"
Term2's value would be " AND NOT mytag=Term2"
Term3's value would be " " or blank -- it could appear or not

So that the search would be "source=mysource mysearchstuff AND mytag=Term1 AND NOT mytag=Term2 ". I can get the repeating list, I think--but I don't know about the dropdown.

Any ideas or is this just too far out there?

Thanks!

Re: Repeating control in form?

RicoSuave — Mon, 30 Jan 2012 13:59:26 GMT

Hello. Check out Nick's sideview utils app on splunkbase. It adds several new modules for use, one of them being a checkbox module that will allow you to do just this. You'll be able to assign each checkbox a value that when clicked will be inserted into a search.

Sideview

Re: Repeating control in form?

wwhitener — Mon, 30 Jan 2012 15:16:57 GMT

To be honest, I was trying to get around the lack of checkboxes with the dropdowns. Do you know if the checkboxes can be dynamic--fed from a lookup query?