How do I set choice value if I need fields where value is greater than zero?

[almar_cabato]

I tried below:

<input type="radio" token="duration.input" searchWhenChanged="true">
  <label>Call Duration</label>
  <choice value=">0">Non-Zero</choice>
  <choice value="0">Zero</choice>
  <choice value="*">All</choice>
  <default>All</default>
</input>


             sourcetype=callrecords
              duration="$duration.input$"
              | table field1, field2, field3
      </query>

I cannot get this working when I choose "Non-Zero."

Thanks a lot.

[ktugwell_splunk]

Hi Almar,

You've got a couple of options here:

You can either use the token prefix and place a search or where command in there, or do something like this:

<form>
  <label>Test1</label>
  <fieldset submitButton="false">
    <input type="radio" token="values_token">
      <label>Values</label>
      <choice value="where count=0">Zero</choice>
      <choice value="where count!=0">Non-Zero</choice>
      <choice value="where isnotnull(count)">All</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <title>Results</title>
        <search>
          <query>| makeresults count=10 |   streamstats count | eval count=count-1 | $values_token$</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

[almar_cabato]

Thanks, let me try it.

Regards,
Almar