Dear All,
I have a YES/NO field named "FIELD2" which I want to search with a single checkbox token named "Checkbox1" , in the following way:
Checkbox1.checked = TRUE
search: index=db FIELD1= FIELD2="YES"
Checkbox2.checked = FALSE
search: index=db FIELD1= FIELD2="*"
or better
search: index=db FIELD1=
I tried with condition and match but no result.
Can someone advise "from scratch"?
best regards
Altin
I open the search loop button and see the whole search in a new Search form. there I can see how the token2 comes, and also from the result itself
Splunk Version
6.5.2
I am not sure why its not working, you can try to unset the values of token in finalization event of search.
I am using this to view the values of token-
test_db1
<input type="checkbox" token="checkbox1" searchWhenChanged="true">
<label></label>
<choice value="YES">On</choice>
<change>
<condition match="$checkbox1$=="YES"">
<eval token="token2">"YES"</eval>
<!--<unset token="checkbox1"></unset>-->
</condition>
<condition>
<eval token="token2">"*"</eval>
</condition>
</change>
<delimiter> </delimiter>
</input>
<panel>
<title>"$token2$"</title>
<search>
<query>|makeresult|eval a=1|table a</query>
</search>
</panel>
I pasted the checkbox as from above, it still works in the opposite.
regards
Altin
It should not happen that way, did you try clearing the browser cache ?
I tried with another browser, still the same result - opposite of what should be.
regards
Altin