Help creating form dedup radio button

[POR160893]

Hi,

I am relatively new to creating forms in Splunk.

At the moment, I am creating a form which contains a radio button called "Dedup".
The function of this radio button is is to remove all duplicate events which are identical with respect to sourcetype, source IP, dest IP, and dest port. Furthermore, the radio button should be empty by default.
At the moment, the radio button is simply greyed out on the UI. I am unsure whether I need to extend the base search already defined on the form? Can you please help?

Attached is an image of the XML code and the UI output.

[POR160893]

Perfect, the check box would be a cleaner solution to this actually.

For my dropdown, is there an "neater" alternative to using "&quot"?

[ITWhisperer]

Is it a radio button that you want? Normally, a radio button would represent an exclusive choice from a group of options. You only have two options, to dedup or not to dedup (as the bard might have said!). Would a checkbox be more what you are looking for?

    <input type="radio" token="radioDedup" searchWhenChanged="true">
      <label>Dedup</label>
      <choice value="| dedup sourcetype source_ip dest_ip dest_port">Yes</choice>
      <choice value="">No</choice>
      <default></default>
    </input>
    <input type="checkbox" token="checkboxDedup" id="checkDedup">
      <label>Dedup</label>
      <choice value="| dedup sourcetype source_ip dest_ip dest_port">Dedup</choice>
      <default></default>
      <initialValue></initialValue>
    </input>

[POR160893]

Perfect, the check box would be a cleaner solution to this actually.

For my dropdown, is there an "neater" alternative to using "&quot"?

[ITWhisperer]

There isn't really a "neater" solution because that's the way to encode embedded quotes in a string in XML.

[POR160893]

The reason why I ask is because the dropdown I currently have is not working ..... no results appear.

[POR160893]

Can I change the values to just append onto the base search perhaps? The 3 options simply depend on 1 sourcetype, and in the case of "BOTH" value, 2 sourcetypes.

[ITWhisperer]

Yes, how are you using the token in your search?

[POR160893]

I am actually not sure myself. For the drop down, I set the token to "action" ..... but this token is not used by any of the values and I am not sure how the prefix uses the token either.I think this is the input failing my form.
However, I am not sure. I would be open for any advice or help on how to better use the token for this dropdown as I have been trying to fix this all day now.