Dashboards & Visualizations

Search a yes/no field with a single checkbox token

altink
Builder

Dear All,

I have a YES/NO field named "FIELD2" which I want to search with a single checkbox token named "Checkbox1" , in the following way:

Checkbox1.checked = TRUE   
search:  index=db FIELD1= FIELD2="YES"

Checkbox2.checked = FALSE  
search:  index=db FIELD1= FIELD2="*"
or better
search:  index=db FIELD1=

I tried with condition and match but no result.

Can someone advise "from scratch"?

best regards
Altin

Tags (2)
0 Karma

altink
Builder

I open the search loop button and see the whole search in a new Search form. there I can see how the token2 comes, and also from the result itself

0 Karma

altink
Builder

Splunk Version
6.5.2

0 Karma

Vijeta
Influencer

I am not sure why its not working, you can try to unset the values of token in finalization event of search.
I am using this to view the values of token-

test_db1

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
  <label></label>

  <choice value="YES">On</choice>
  <change>
    <condition match="$checkbox1$==&quot;YES&quot;">
      <eval token="token2">"YES"</eval>
      <!--<unset token="checkbox1"></unset>-->
    </condition>
    <condition>
      <eval token="token2">"*"</eval>
    </condition>
  </change>
  <delimiter> </delimiter>



</input>


<panel>
  <title>"$token2$"</title>
        <search>
    <query>|makeresult|eval a=1|table a</query>
  </search>
</panel>
0 Karma

altink
Builder

I pasted the checkbox as from above, it still works in the opposite.

regards
Altin

0 Karma

Vijeta
Influencer

It should not happen that way, did you try clearing the browser cache ?

0 Karma

altink
Builder

I tried with another browser, still the same result - opposite of what should be.

regards
Altin

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...