Dashboards & Visualizations
Highlighted

Checkbox field in dashboard is searching for unwanted blank value

Engager

I have a panel on a dashboard with a checkbox input. I'm unable to make this panel work with a checkbox input.

Error:

Error in 'search' command: Unable to parse the search: Comparator '=' is missing a term on the left hand side.

Search String:

EAP $CB_MSOMAC$ | timechart count(client_mac) by client_mac

Dropdown Config(XML Brackets replaced to show code):

  {input type="checkbox" token="CB_MSOMAC" searchWhenChanged="true"}
    {label}MAC Addresses{/label}
    {choice value="58:94:6B:XX:XX:XX"}58:94:6B:XX:XX:XX{/choice}
    {choice value="5C:51:4F:XX:XX:XX"}5C:51:4F:XX:XX:XX{/choice}
    {choice value="60:45:BD:XX:XX:XX"}60:45:BD:XX:XX:XX{/choice}
    {default},60:45:BD:XX:XX:XX,58:94:6B:XX:XX:XX,5C:51:4F:XX:XX:XX{/default}
    {prefix}({/prefix}
    {suffix}){/suffix}
    {valuePrefix}client_mac={/valuePrefix}
    {delimiter} OR {/delimiter}
  {/input}

alt text

If I open the query in search without any of the checkbox options selected, the search string looks like this:

EAP (client_mac=) | timechart count(client_mac) by client_mac

The problem is pretty obvious, as it would appear that I have an incomplete query parameter. Checking and unchecking boxes in the dashboard input will add and remove their associated values from the search string, but nothing I have done has removed "(client_mac=)" from the query. What have I done wrong? Or is this a bug?

0 Karma
Highlighted

Re: Checkbox field in dashboard is searching for unwanted blank value

SplunkTrust
SplunkTrust

Update your data input with this

<valuePrefix>client_mac="</valuePrefix>
<valueSuffix>"</valueSuffix>
0 Karma