I have a Splunk dashboard as follows with some input fields.
Now As you can see above by default the input value for host column is wild card * . Now, If I click the checkbox "show" under Latency validation check it will display a panel below it.
Now, as a good practice how do I disable executing the search when some one used the wild card in host input as the input will be used as a token for the search.
I mean only when a valid hostname is given as an input for Host the search should execute for the Latency Validation check.
Note :-
Here I need the wild card as a default entry for host input as there are some other panels which uses that wild card but I only wanted to restrict the use of wild card to only one particular panel.
Code can be found below :-
<input type="text" token="host">
<label>Host</label>
<default>*</default>
</input>
<input type="checkbox" token="overview">
<label>Latency Validation Check</label>
<choice value="true">Show</choice>
<change>
<condition label="Show">
<set token="overview">true</set>
</condition>
</change>
</input>
Update the token for host filter to "host_temp".
Use similar <change> for host input and use <condition> and with <eval> check if the value contains * (wildcard) or not.
If it does not contain a wildcard set a new token "host".
If it contains wildcard unset the token "host".