topic Re: Checkbox not working in Splunk Search

Why is checkbox not working?

POR160893 — Fri, 25 Feb 2022 18:36:59 GMT

Hi,

I have created a dashboard to filter firewall statuses. One of the inputs I need is a checkbox to eliminate duplicates based on host, source IP, destination IP and destination port.

However, the checkbox input is not working and every time the use checks and unchecks the box, it has no effect on the dashboard.

The following is my dashboard and the XML code, respectively:

Can you please help?

Thank you!

Re: Checkbox not working

richgalloway — Fri, 25 Feb 2022 15:29:03 GMT

Please share the part of the dashboard code that uses the $checkboxDedup$ token.

Re: Checkbox not working

POR160893 — Fri, 25 Feb 2022 15:39:28 GMT

At the moment, this token is not been used.

I don't know how to incorporate it into one of my queries so that duplicates over 4 fields are detected.

As you can see from the below code, I am already using the tokens from the other inputs in the base searches:

However, for this checkbox, since I need to detect duplicates across source IP, dest IP, dest Port AND sourcetype, and I am already using a sourcetype token in my dropdown, I don't know how to make use make use of the 1 token in the checkbox when it would make sense to have 4 tokens ....... can you please help

Re: Checkbox not working

Marco_Develops — Fri, 25 Feb 2022 16:14:14 GMT

Have you considered using the submit button? In order to use the submit button you have to change "search on change" off on all your other inputs.

-Marco

Re: Checkbox not working

richgalloway — Fri, 25 Feb 2022 19:07:19 GMT

I think you only need one token, not 4 for dedup. Just add the token between the table and first lookup commands.

| table ... $checkboxDedup$ | lookup ...

Re: Checkbox not working

POR160893 — Sun, 27 Feb 2022 16:21:10 GMT

When I added the dedup in between the table and lookup, the UI is now looking for some argument:

Can you please help?

Re: Checkbox not working

richgalloway — Sun, 27 Feb 2022 18:50:42 GMT

Since the token already contains a dedup command, saying | dedup $checkboxDedup$ is equivalent to saying | dedup | dedup $sourcetype_tok$, $dest$, $src$, $port$.

Try the answer provided or change the token to not contain "| dedup"

Re: Checkbox not working

POR160893 — Mon, 28 Feb 2022 12:03:48 GMT

The submit button with the Dedup condition does work now .... but only on fields with the same name across both indexes. Here is the source query with the Dedup token been used:

However, I need to also have it check for dedup for src_ip and dest_ip. My issue is on the 2nd index, these two fields are called src and dest, respectively.

I tried using both names with an OR in the dedup but that did not work. Can you please help?

Re: Checkbox not working

POR160893 — Mon, 28 Feb 2022 12:04:49 GMT

Hey, The submit button with the Dedup condition does work now .... but only on fields with the same name across both indexes. Here is the source query with the Dedup token been used:

However, I need to also have it check for dedup for src_ip and dest_ip. My issue is on the 2nd index, these two fields are called src and dest, respectively.

I tried using both names with an OR in the dedup but that did not work. Can you please help?

Re: Checkbox not working

richgalloway — Mon, 28 Feb 2022 15:30:45 GMT

The dedup command does not accept expressions - only field names. You'll probably need to normalize the field names using rename or coalesce (or other method) for dedup to work as expected.

Re: Checkbox not working

schalb — Fri, 20 Oct 2023 03:46:42 GMT

I've had the exact same use case and found a work around. Added this just in case anyone else stumbles across it.

Update the default option to noop, so it reverts to this when the checkbox is deselected
<input type="checkbox" token="dedupresults">
<choice value="dedup src,dest">Dedup</choice>
<default>noop</default>
</input>

And insert the token into your search.
.... | $dedupresults$ | .....

This will result in the search being either

... | dedup src,dest | ..... or ... | noop | .....