Dashboards & Visualizations

How to exclude results from a saved search in a dashboard using a checkbox?

snix
Communicator

I have a saved search that shows IIS logs on a dashboard, it can be a bit verbose depending on the use case. I would like to have an on/off input that would allow the user to filter out some of the non-relevant logs. I figured the checkbox input would make the most sense but I am having issues wrapping my head around how it works and am starting to wander if it is the best option for this solution.

Whatever option I would use would just need to be able to by default filter nothing but if selected add a string into the search for example:

Default off: InputVariable="HTTPStatusCode=*"
Turned on: InputVariable="HTTPStatusCode!=200"
search index=iis $InputVariable$| table field1, field2, field3

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You could use something like this:

<input type="radio" token="field1">
  <choice value="HTTPStatusCode=*">show</choice>
  <choice value="HTTPStatusCode!=200">hide</choice>
</input>

With a one-option checkbox, the unchecked state would leave the token unset - causing the search to wait for input. A radio input is always set, at least when you define an initial/default value.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You could use something like this:

<input type="radio" token="field1">
  <choice value="HTTPStatusCode=*">show</choice>
  <choice value="HTTPStatusCode!=200">hide</choice>
</input>

With a one-option checkbox, the unchecked state would leave the token unset - causing the search to wait for input. A radio input is always set, at least when you define an initial/default value.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

That radio input is one input with two options 🙂

0 Karma

snix
Communicator

Oh I thought I would need to add a second radio button and tie them together, that makes more sense I will take another look at it then and see what it can do.

Thank You!

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You can't uncheck a radio button, but you can select the second option to unselect the first option.

0 Karma

snix
Communicator

I will mark it answered since you did hit on the key issue of the unset token when using the check box make it unusable.

0 Karma

snix
Communicator

I figured as much but for some reason I didn't like the idea of dealing with two inputs when I could set it to deal with only one. So I avoided looking down that path and just trying the dropdown, figured it would then give me room for more filter options in the future if I think of some more.

0 Karma

snix
Communicator

@martin_mueller I tried your suggestion but ran into the issue of unchecking the radio button, it appears to not be an option so I tried the dropdown and got it to work for what I need. Just wish I would have been able to use the checkbox 😞

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...