Is there a way to turn on and off Events Splunk 7

[robertlynch2020]

Hi

I have created the following way to turn on events Splunk 7 easly, however can turn them off.

I use a eval foo="$EVENT_ON_OFF$" and a check box, however i cant get them off when i want them to.

 <row>
    <panel>
      <input type="checkbox" token="EVENT_ON_OFF" searchWhenChanged="true">
        <label>EVENT_ON_OFF</label>
        <choice value="ON">ON</choice>
        <delimiter> </delimiter>
      </input>
      <chart>
        <title>CPU by source - Events Overlay</title>
        <search type="annotation">
          <query>| tstats values("AMBER_EVENTS.evt.lvl") as "Count" from datamodel="AMBER_EVENTS" where "nodename"="AMBER_EVENTS" host=mx7654vm_ROB_AMBER_2 groupby _time, source ,AMBER_EVENTS.evt.lvl,AMBER_EVENTS.evt.dsc span=5s | eval foo="$EVENT_ON_OFF$" | rename AMBER_EVENTS.evt.lvl as INFO | rename AMBER_EVENTS.evt.dsc as MESSAGE
| eval annotation_label = MESSAGE
| eval annotation_category = INFO | table _time annotation_label annotation_category</query>
          <earliest>$global_time_tok.earliest$</earliest>
          <latest>$global_time_tok.latest$</latest>
        </search>
        <search>
          <query>| tstats avg("AMBER_METRIC.mtr.gauges.process.cpu.percentage") as "Avg" from datamodel="AMBER_METRIC" where "nodename"="AMBER_METRIC" host=mx7654vm_ROB_AMBER_2 groupby _time, source span=100s
 | timechart first("Avg") as "Avg" agg=max limit=5 useother=false span=100s by source</query>
          <earliest>$global_time_tok.earliest$</earliest>
          <latest>$global_time_tok.latest$</latest>
        </search>
        <option name="charting.axisY.abbreviation">auto</option>
        <option name="charting.axisY.includeZero">1</option>
        <option name="charting.chart">line</option>
        <option name="charting.chart.nullValueMode">connect</option>
        <option name="charting.drilldown">all</option>
        <option name="charting.fieldColors">{"/net/mx7654vm/data/apps/MX_ROB/logsrob7/authn/authn-app-0.1/5691a977-9a7c-4865-ba6a-aa0e9071d9b6.log_METRIC.log":"#1e93c6","/net/mx7654vm/data/apps/MX_ROB/logsrob7/counterpart/counterpart-app-0.1/e11a1aca-aed9-447c-8d51-bde79213dea9.log_METRIC.log":"#f2b827","/net/mx7654vm/data/apps/MX_ROB/logsrob7/counterpart/counterpart-0.1/4736d9d6-8224-4975-9e39-889eb346be90.log_METRIC.log":"#d6563c","/net/mx7654vm/data/apps/MX_ROB/logsrob7/counterpart/counterpart-0.1/ce142cf0-2cdb-47eb-8d08-13ef20690585.log_METRIC.log":"#6a5c9e","/net/mx7654vm/data/apps/MX_ROB/logsrob7/counterpart/counterpart-0.1/dca63eb4-ee82-4c96-92cf-c6f55ba0cc3d.log_METRIC.log":"#31a35f"}</option>
        <option name="charting.gridLinesX.showMajorLines">1</option>
        <option name="charting.legend.labelStyle.overflowMode">ellipsisEnd</option>
        <option name="charting.legend.mode">standard</option>
        <drilldown>
          <link target="_blank">/app/murex_mlc/amber_events</link>
        </drilldown>
      </chart>
    </panel>
  </row>

[Elsurion]

Hello

I've done it that way.
The checkbox has a searchfragment in it, where i select only Errors in my case

    <input type="checkbox" token="only_errors" searchWhenChanged="true">
      <label>Zeige</label>
      <default></default>
      <choice value="OSCOMPSTAT != 0">Nur Errors</choice>
    </input>

In the Tablequery i'm using then the fragment like this:

          <query>index=controlm sourcetype=controlm-ajf JOBNAME="$jobname$" $only_errors$ host=$ctmsrv$
                | eval STARTRUN=strptime(STARTRUN,"%Y%m%d%H%M%S")
                | eval ENDRUN=strptime(ENDRUN,"%Y%m%d%H%M%S")
                | eval start=strftime(STARTRUN,"%F %T") 
                | eval end=strftime(ENDRUN,"%F %T") 
                | eval duration=round(ELAPTIME/100,2)
                | ctmbase36
                | rename NODEID as exechost, OSCOMPSTAT as exitcode
                | table start, end, orderid, exechost duration, exitcode</query>

This will expand the search with "OSCOMPSTAT != 0 when ticked and with "" when not ticked.