Getting Data In

How do I set choice value if I need fields where value is greater than zero?

almar_cabato
New Member

I tried below:

<input type="radio" token="duration.input" searchWhenChanged="true">
  <label>Call Duration</label>
  <choice value=">0">Non-Zero</choice>
  <choice value="0">Zero</choice>
  <choice value="*">All</choice>
  <default>All</default>
</input>


             sourcetype=callrecords
              duration="$duration.input$"
              | table field1, field2, field3
      </query>

I cannot get this working when I choose "Non-Zero."

Thanks a lot.

Tags (1)
0 Karma

ktugwell_splunk
Splunk Employee
Splunk Employee

Hi Almar,

You've got a couple of options here:

You can either use the token prefix and place a search or where command in there, or do something like this:

<form>
  <label>Test1</label>
  <fieldset submitButton="false">
    <input type="radio" token="values_token">
      <label>Values</label>
      <choice value="where count=0">Zero</choice>
      <choice value="where count!=0">Non-Zero</choice>
      <choice value="where isnotnull(count)">All</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Results</title>
        <search>
          <query>| makeresults count=10 |   streamstats count | eval count=count-1 | $values_token$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

almar_cabato
New Member

Thanks, let me try it.

Regards,
Almar

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...