topic How to exclude results using checkbox? in Splunk Search

How to exclude results using checkbox?

tomapatan — Thu, 02 Feb 2023 14:44:34 GMT

I have the following search which returns a table of all hostnames and operating systems.

| inputlookup hosts.csv
| search OS="*server*"
| table hostname, OS

I would like to add a checkbox to exclude Windows Server 2008 builds. This is what I have so far:

<row>
<panel>
<input type="checkbox" token="checkbox" searchWhenChanged="true">
<label></label>
<choice value="Windows Server 2008*">Exclude Server 2008</choice>
<change>
<condition match="$checkbox$=="Enabled"">
<set token="setToken">1</set>
</condition>
<condition>
<unset token="setToken"></unset>
</condition>
</change>
</input>
</panel>
</row>

New panel to show server builds depending on the checkbox:

<query>

| inputlookup hosts.csv
| search OS="*server*" AND OS!="$checkbox$"
| stats count as total

<query>

This only works when the checkbox is selected and correctly excludes the 2008 builds from the search, but doesn`t display anything when the checkbox is unselected. I would like to display all devices when the checkbox is unselected.

Re: Exclude results using checkbox

PaulPanther — Thu, 02 Feb 2023 12:43:58 GMT

<row> <panel> <input type="checkbox" token="checkbox" searchWhenChanged="true"> <label></label> <choice value="Windows Server 2008*">Exclude Server 2008</choice> <delimiter> </delimiter> <change> <condition label="Exclude Server 2008"> <set token="tokenFilter">AND OS!="Windows Server 2008*"</set> </condition> <condition> <set token="tokenFilter"></set> </condition> </change> </input> </panel> </row>

and adjust your search like

| inputlookup hosts.csv | search OS="*server*" $tokenFilter$ | stats count as total

Re: Exclude results using checkbox

tomapatan — Thu, 02 Feb 2023 13:08:27 GMT

Thanks Paul, unfortunately it now does the opposite as before: displays correctly when the checkbox is selected and no content when it`s checked.

Re: Exclude results using checkbox

PaulPanther — Thu, 02 Feb 2023 13:21:39 GMT

Just use below test dashboard for verification. There might be something wrong in your search or in the input config. Feel free to share your code.

<form version="1.1"> <label>Test_checkbox</label> <fieldset submitButton="false"></fieldset> <row> <panel> <input type="checkbox" token="checkbox" searchWhenChanged="true"> <label></label> <choice value="Windows Server 2008*">Exclude Server 2008</choice> <delimiter> </delimiter> <change> <condition label="Exclude Server 2008"> <set token="tokenFilter">AND OS!="Windows Server 2008*"</set> </condition> <condition> <set token="tokenFilter"></set> </condition> </change> </input> </panel> </row> <row> <panel> <event> <search> <query>index=_internal OS="*server*" $tokenFilter$ | stats count as total</query> <earliest>-24h@h</earliest> <latest>now</latest> </search> <option name="list.drilldown">none</option> <option name="refresh.display">progressbar</option> </event> </panel> </row> </form>

Re: Exclude results using checkbox

tomapatan — Thu, 02 Feb 2023 13:35:26 GMT

Thanks Paul,

I made the mistake of encapsulating $tokenFilter$ in double quotes. Works fine without the quotes.