use token in dashboard with if statement

[sarit_s]

Hello
I have a dashboard with this search 

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" if $host$="yes" [| inputlookup windows_hosts_srv_2016.csv  | fields host | format] | timechart max(Value) by host span=5m

I want to add checkbox so the defualt search will be

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" if $host$="yes" host=* | timechart max(Value) by host span=5m

and if the client clicks on the checkbox then it will search by the first query 

how it can be done ?

thanks

[richgalloway]

If the checkbox is selected then have the token value be "host=*".  If it is not selected then the token should contain the subsearch.  Then the query becomes

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" $host$ | timechart max(Value) by host span=5m

[sarit_s]

Where should I add the conditions?

[richgalloway]

In the <input> element where the token is defined.

[sarit_s]

should it be something like this: 

<form>
  <label>Clock sync Clone</label>
  <fieldset submitButton="false">
    <input type="time" token="field1">
      <label></label>
      <default>
        <earliest>-15m</earliest>
        <latest>now</latest>
      </default>
    </input>
    <input type="checkbox" token="field2">
      <label>field2</label>
      <choice value="yes">Check for listed hosts</choice>
      <delimiter> </delimiter>
      <change>
        <condition value="yes">
          <query>sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset" $host$ | timechart max(Value) by host span=5m</query>
        </condition>
        <condition>
          <eval token="checked_result_value">"B"</eval>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <title>Time sync Windows servers 2016</title>
      <chart>
        <title>Time sync Windows servers 2016</title>
        <search>
          <query>sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset"  [| inputlookup windows_hosts_srv_2016.csv  | fields host | format] | timechart max(Value) by host span=5m</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.axisTitleX.visibility">visible</option>
        <option name="charting.axisTitleY.visibility">visible</option>
        <option name="charting.axisTitleY2.visibility">visible</option>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="charting.legend.placement">right</option>
        <option name="height">262</option>
        <option name="refresh.display">progressbar</option>
        <option name="trellis.enabled">0</option>
      </chart>
    </panel>
  </row>
  <row>
    <panel>
      <title>Time sync Windows servers 2012</title>
      <chart>
        <search>
          <query>sourcetype=timekeeper_status [| inputlookup windows_hosts_srv_2012.csv | fields host | format] | timechart max(offsets."0") by host</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

i think im a little bit confused

[richgalloway]

I was thinking of something like this:

    <input type="checkbox" token="field2">
      <label>field2</label>
      <choice value="yes">Check for listed hosts</choice>
      <delimiter> </delimiter>
      <change>
        <condition value="yes">
          <set token="host">[| inputlookup windows_hosts_srv_2012.csv | fields host | format]</set>
        </condition>
        <condition>
          <set token="host">*</set>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
...
  </row>
  <row>
    <panel>
      <title>Time sync Windows servers 2012</title>
      <chart>
        <search>
          <query>sourcetype=timekeeper_status $host$ | timechart max(offsets."0") by host</query>
          <earliest>$field1.earliest$</earliest>
          <latest>$field1.latest$</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>

[sarit_s]

i changed the query you wrote since i think there was a type
the query should be 

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset"  $host$ | timechart max(Value) by host span=5m

but now i have 2 issues:

1. i have 2 panels with different csv file but i want the same checkbox to change them so i think it is impossible to put the file name in the token, no ?

2. if the checkbox is unchecked then i get this query:

sourcetype="Perfmon:Windows Time Service" counter="Computed Time Offset"  * | timechart max(Value) by host span=5m

and it should be host=* and not just *

also, the graph is now showing dots...

[richgalloway]

1. Using 2 difference CSVs is possible, but you'll have to use 2 tokens.  Set them both in the same <change> element with two <set> elements.

2. My bad.  The token should be set to "host=*" if the checkbox is not selected.

[sarit_s]

Where should I set the host=*? I don’t see we configured it anywhere

what about the dots issue? Before the changes it was lines

[richgalloway]

Instead of

<set token="host">*</set>

use

<set token="host">host=*</set>

As for the dots problem, have you checked the format settings for the visualization?

[sarit_s]

its working, thanks

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.