Dashboards & Visualizations

Use of checkbox to govern annotations

martinhelgegren
Explorer

Been Googling (as a novice user of SPLUNK) for a while in search of an answer but haven't had the luck so I'll try posting a Q. I'm using annotations in-line with timecharts in various searches. The UI source looks like this:

<search id="base_annotation">
    <query>index=my_index | eval My_value = 'host' + " " + 'another_field' | eval annotation_label = Host_value</query>
    <earliest>$timefield.earliest$</earliest>
    <latest>$timefield.latest$</latest>
  </search>


I then add the resulting base_annotation into the relevant timecharts of my dashboard using:

</search>
          <search type="annotation" base="base_annotation">
          <query></query>
        </search>

...beneath the original query. This works well but I'd like to make the annotations optional to the users. Hence I'd imagine there is a way to let a checkbox govern the presence of annotation in the timecharts ie. if the checkbox is checked then keep the code as is, if un-checked then run the searches without the search type="annotation".

Any hints anyone?
Kind regards

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You could use a checkbox to set a token to true or false and append a where clause to your annotation query so that it only returns results if the token is true, or something like that.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...