I have a panel on a dashboard with a search using a token to exclude events with some field values.
Search is something like
index=myindex sourcetype=mysourcetype $exclude$
The "exclude" token is generated from a checkbox input which generate a string like "myfield!=value1 myfield!=value2 ..."
This is working fine if at less one entry on checkbox is selected but a have the message
Search is waiting for input...if no entries are selected.
I open the panel in search and see
undefined on search bar.
Is it possible to run the search even if the token is not defined or to have an empty defined token if all entries on checkbox are unchecked?
if you set the token to nothing, it should work:
<init> <set token="exclude"> </set> </init>
and then did a
<change> <condition value="true"> <set token="exclude">true</set> </condition> </change>
however, this will always make exclude equal to something, so if you're using it in a depends statement, it won't work anymore. you'd need possibly eval a new token with
condition match to make the depends work.
@ktn01, while you have not shared SimpleXML code for your checkbox, following is an example based on Splunk's _internal index.
I have defined introduced an empty checkbox choice
None for Exclusion
<choice value="">None</choice>, which is the default selection
<input type="checkbox" token="tokExclude"> <label>Exclude</label> <choice value="">None</choice> <choice value="log_level!="INFO"">INFO</choice> <choice value="log_level!="ERROR"">ERROR</choice> <choice value="log_level!="WARN"">WARN</choice> <choice value="log_level!="FATAL"">FATAL</choice> <default></default> </input>
Following is the query which runs on Splunk's
<query>index=_internal sourcetype=splunkd $tokExclude$ | stats count</query>
i have the same issue mention above but in my dashboard i have two dropdowns with Apps and Indexes , i have passed a token of App dropdown to index. Here when i select the Particular App Dropdown it will show the index which it has, for Some apps there is no index then the the panels are show that search is waiting for input but my question is that i have to show in the panels 0 Value instead of search is waiting for the input, Help me with this.