Getting Data In

How do I set choice value if I need fields where value is greater than zero?

almar_cabato
New Member

I tried below:

<input type="radio" token="duration.input" searchWhenChanged="true">
  <label>Call Duration</label>
  <choice value=">0">Non-Zero</choice>
  <choice value="0">Zero</choice>
  <choice value="*">All</choice>
  <default>All</default>
</input>


             sourcetype=callrecords
              duration="$duration.input$"
              | table field1, field2, field3
      </query>

I cannot get this working when I choose "Non-Zero."

Thanks a lot.

Tags (1)
0 Karma

ktugwell_splunk
Splunk Employee
Splunk Employee

Hi Almar,

You've got a couple of options here:

You can either use the token prefix and place a search or where command in there, or do something like this:

<form>
  <label>Test1</label>
  <fieldset submitButton="false">
    <input type="radio" token="values_token">
      <label>Values</label>
      <choice value="where count=0">Zero</choice>
      <choice value="where count!=0">Non-Zero</choice>
      <choice value="where isnotnull(count)">All</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Results</title>
        <search>
          <query>| makeresults count=10 |   streamstats count | eval count=count-1 | $values_token$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

almar_cabato
New Member

Thanks, let me try it.

Regards,
Almar

0 Karma
Get Updates on the Splunk Community!

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...