Been Googling (as a novice user of SPLUNK) for a while in search of an answer but haven't had the luck so I'll try posting a Q. I'm using annotations in-line with timecharts in various searches. The UI source looks like this:
<search id="base_annotation">
<query>index=my_index | eval My_value = 'host' + " " + 'another_field' | eval annotation_label = Host_value</query>
<earliest>$timefield.earliest$</earliest>
<latest>$timefield.latest$</latest>
</search>
I then add the resulting base_annotation into the relevant timecharts of my dashboard using:
</search>
<search type="annotation" base="base_annotation">
<query></query>
</search>
...beneath the original query. This works well but I'd like to make the annotations optional to the users. Hence I'd imagine there is a way to let a checkbox govern the presence of annotation in the timecharts ie. if the checkbox is checked then keep the code as is, if un-checked then run the searches without the search type="annotation".
Any hints anyone?
Kind regards
