No, I hadn't tried adding another static check box.
Yes, that works.
I looked at the "Check Box Input" example in the Splunk 6.x Dashboard Examples app, and it seems that this behavior - "Search is waiting for input" when no check boxes are selected - is by design. I can imagine this behavior was the subject of some debate between the Splunk designers. I have mixed feelings about it.
In my specific case, I want to offer the user a choice between two states:
Exclude blacklisted transaction codes (the default state)
For this case - without considering Splunk-specific implementation issues - a single check box seemed to me the most appropriate choice of UI control.
However, in Splunk, as we've seen, if no check box in a group is selected, the corresponding token remains unset, resulting in a "Search is waiting for input" message, which is not the behavior I want. At least, not in this situation; I'm open to learning about situations where this behavior is desirable.
Thanks again for your answer. It's prompted me to rethink how to represent such a choice to the user in a way that is straightforward to implement in Splunk.
Rather than introducing a second check box, which, logically, offers the user a choice between not two but four states, I have, for now, replaced the single check box with two radio buttons:
Blacklisted transaction codes:
[ ] Include
I'd still prefer to use a single check box, but this is an acceptable workaround for me.
Finally, regarding the "Check Box Input" example in the Splunk 6.x Dashboard Examples app... I think that the presence of the "ANY" check box in this group is problematic (I can elaborate, if asked). And if you select multiple check boxes and inspect the resulting search string, you can see that the "OR" delimiter lacks leading and trailing spaces:
I'm currently using a free Splunk license on my PC (I'm discussing this situation with local management), so I can't submit a case for that. What, if anything, should I do about that? Report it here in the guise of a question, perhaps? (Or buy a license. Yes, fair call.)