I tried below:
<input type="radio" token="duration.input" searchWhenChanged="true">
<label>Call Duration</label>
<choice value=">0">Non-Zero</choice>
<choice value="0">Zero</choice>
<choice value="*">All</choice>
<default>All</default>
</input>
sourcetype=callrecords
duration="$duration.input$"
| table field1, field2, field3
</query>
I cannot get this working when I choose "Non-Zero."
Thanks a lot.
Hi Almar,
You've got a couple of options here:
You can either use the token prefix and place a search
or where
command in there, or do something like this:
<form>
<label>Test1</label>
<fieldset submitButton="false">
<input type="radio" token="values_token">
<label>Values</label>
<choice value="where count=0">Zero</choice>
<choice value="where count!=0">Non-Zero</choice>
<choice value="where isnotnull(count)">All</choice>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Results</title>
<search>
<query>| makeresults count=10 | streamstats count | eval count=count-1 | $values_token$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</form>
Thanks, let me try it.
Regards,
Almar