Use of checkbox to govern annotations

[martinhelgegren]

Been Googling (as a novice user of SPLUNK) for a while in search of an answer but haven't had the luck so I'll try posting a Q. I'm using annotations in-line with timecharts in various searches. The UI source looks like this:

<search id="base_annotation">
    <query>index=my_index | eval My_value = 'host' + " " + 'another_field' | eval annotation_label = Host_value</query>
    <earliest>$timefield.earliest$</earliest>
    <latest>$timefield.latest$</latest>
  </search>

I then add the resulting base_annotation into the relevant timecharts of my dashboard using:

</search>
          <search type="annotation" base="base_annotation">
          <query></query>
        </search>

...beneath the original query. This works well but I'd like to make the annotations optional to the users. Hence I'd imagine there is a way to let a checkbox govern the presence of annotation in the timecharts ie. if the checkbox is checked then keep the code as is, if un-checked then run the searches without the search type="annotation".

Any hints anyone?
Kind regards

[ITWhisperer]

You could use a checkbox to set a token to true or false and append a where clause to your annotation query so that it only returns results if the token is true, or something like that.