Using a checkbox to add to the search

[jbradley76]

Hello,

I have a working dash that searches our web logs returns the results based off of a Category, which is chosen from a drop down. The search results should not include any URL's that end in image extensions. However there is a request to have just a single checkbox that allows images extensions in the results. Is there an option to have a single check box add/remove a variable?

Right now I've cheated by adding a second drop down that is defaulted to remove the images, and when changed, excludes an imaginary file extension, basically "only exclude a file extension you'll never find". As shown below.

Anything that pulls that off with a single checkbox?

  <fieldset submitButton="false">
    <input type="dropdown" token="pc" searchWhenChanged="true">
      <label>Weblog Category</label>
      <choice value="Hacking">Hacking</choice>
      <choice value="Malware">Malware</choice>
    </input>
    <input type="dropdown" token="url" searchWhenChanged="true">
      <label>Images</label>
      <choice value="url!=*.gif url!=*.png url!=*.jpg url!=*.ico">Remove Image Extensions</choice>
      <choice value="url!=*.filedoesnotexist">Include Image Extensions</choice>
      <default>url!=*.gif url!=*.png url!=*.jpg url!=*.ico</default>
    </input>

    sourcetype=weblogs user="*" category=$pc$ $url$ | table user category url a bunch of other stuff

[woodcock]

Yes, read about checkbox here:

http://docs.splunk.com/Documentation/Splunk/6.2.4/Viz/PanelreferenceforSimplifiedXML

Here is an answer that shows one way to do it:

http://answers.splunk.com/answers/221926/how-to-set-tokens-for-checkboxes-using-simple-xml.html