Dashboards & Visualizations

checkbox in form or dashboards?

dcroteau
Splunk Employee
Splunk Employee

My customer wants to have a dashboard or a form with something like a checkbox selector.

For instance a specific hidden search returns 22 fields. He would like to have a dashboard with something like 22 checkboxes where a none technical user can go in and select just the fields he wants to appear in an event table.

Example:

"foobar search" |fields $chkbx1$ $chkbx2$ $chkbx19$

In the example above, the user checked the checkbox for fields: field 1, field 2 and field 19.

Is this possible? Can the amount of checkboxes be dynamic based upon the search result and its fields? If there is a better way than checkboxes?....that will be acceptable as well.

Oh, BTW the field picker is to sophisticated for his users and is unfortunately not a viable option and it will not update the event table dynamically anyway (as far as I know)

DC

Tags (1)

sideview
SplunkTrust
SplunkTrust

Im afraid not. Although there are modules like SearchSelectLister and StaticSelect that manifest as pulldowns, and SearchRadioLister and StaticRadio that manifest as radio buttons, and even TextSetting that looks like a plain textfield, there is no equivalent module in the set of 'lister' modules that manifests as a checkbox.

If you write to support and tell them you want and/or need one, it'll get triaged as an enhancement request in our process and automatically get into the queue of stuff reviewed by product management, without too much trouble.

Until then, one thing that's commonly overlooked is that you can make your own view, as simply as cloning the 'flashtimeline' view, and then edit ot to change the default selected fields in the FieldPicker. If you have a class of users that always works with a certain set of fields and is confused when those fields arent selected, edit or clone the flashtimeline view, change the default selected fields in the XML, and then when users hit the page for the first time those fields will be selected.

Or you can go a step further, remove the FieldPicker entirely and replace it with a module called "HiddenFieldPicker". Although this is best done in form-search views where you're really only ever going to be looking at one kind of data.

gkanapathy
Splunk Employee
Splunk Employee

What you probably really need here is a custom UI FieldPicker module.

0 Karma

dcroteau
Splunk Employee
Splunk Employee

So the answer is No? "Out of the box", there is no way to do this.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The field picket does/can update the event table dynamically.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...