Dashboards & Visualizations

Using a checkbox to add to the search

jbradley76
Engager

Hello,

I have a working dash that searches our web logs returns the results based off of a Category, which is chosen from a drop down. The search results should not include any URL's that end in image extensions. However there is a request to have just a single checkbox that allows images extensions in the results. Is there an option to have a single check box add/remove a variable?

Right now I've cheated by adding a second drop down that is defaulted to remove the images, and when changed, excludes an imaginary file extension, basically "only exclude a file extension you'll never find". As shown below.

Anything that pulls that off with a single checkbox?

  <fieldset submitButton="false">
    <input type="dropdown" token="pc" searchWhenChanged="true">
      <label>Weblog Category</label>
      <choice value="Hacking">Hacking</choice>
      <choice value="Malware">Malware</choice>
    </input>
    <input type="dropdown" token="url" searchWhenChanged="true">
      <label>Images</label>
      <choice value="url!=*.gif url!=*.png url!=*.jpg url!=*.ico">Remove Image Extensions</choice>
      <choice value="url!=*.filedoesnotexist">Include Image Extensions</choice>
      <default>url!=*.gif url!=*.png url!=*.jpg url!=*.ico</default>
    </input>

    sourcetype=weblogs user="*" category=$pc$ $url$ | table user category url a bunch of other stuff

woodcock
Esteemed Legend
0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...