I have a saved search that shows IIS logs on a dashboard, it can be a bit verbose depending on the use case. I would like to have an on/off input that would allow the user to filter out some of the non-relevant logs. I figured the checkbox input would make the most sense but I am having issues wrapping my head around how it works and am starting to wander if it is the best option for this solution.
Whatever option I would use would just need to be able to by default filter nothing but if selected add a string into the search for example:
Default off: InputVariable="HTTPStatusCode=*"
Turned on: InputVariable="HTTPStatusCode!=200"
search index=iis $InputVariable$| table field1, field2, field3
You could use something like this:
<input type="radio" token="field1"> <choice value="HTTPStatusCode=*">show</choice> <choice value="HTTPStatusCode!=200">hide</choice> </input>
With a one-option checkbox, the unchecked state would leave the token unset - causing the search to wait for input. A radio input is always set, at least when you define an initial/default value.
@martin_mueller I tried your suggestion but ran into the issue of unchecking the radio button, it appears to not be an option so I tried the dropdown and got it to work for what I need. Just wish I would have been able to use the checkbox 😞
You can't uncheck a radio button, but you can select the second option to unselect the first option.
I figured as much but for some reason I didn't like the idea of dealing with two inputs when I could set it to deal with only one. So I avoided looking down that path and just trying the dropdown, figured it would then give me room for more filter options in the future if I think of some more.
I will mark it answered since you did hit on the key issue of the unset token when using the check box make it unusable.
Oh I thought I would need to add a second radio button and tie them together, that makes more sense I will take another look at it then and see what it can do.