Splunk Search

Can I concatenate a complete search query to the already filtered stats results which only executes if an input checkbox is checked

varun99
Path Finder

I want to add a checkbox input which just concatenates my search with something like " | search Error" if I check that. Is it possible ?

0 Karma
1 Solution

micahkemp
Champion

This is easy with a dropdown, as the below run anywhere dashboard XML illustrates:

<form>
  <label>616525</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="filter_errors" searchWhenChanged="true">
      <label>Filter Errors</label>
      <choice value="| search">No</choice>
      <choice value="| search Error">Yes</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal $filter_errors$ | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

But, unless I'm missing something, using a checkbox will effectively cause your search not to run (at all) if nothing is checked, as the token would be unset, and hence the search would think it needs to wait for input (until the token is set).

View solution in original post

micahkemp
Champion

This is easy with a dropdown, as the below run anywhere dashboard XML illustrates:

<form>
  <label>616525</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="filter_errors" searchWhenChanged="true">
      <label>Filter Errors</label>
      <choice value="| search">No</choice>
      <choice value="| search Error">Yes</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal $filter_errors$ | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

But, unless I'm missing something, using a checkbox will effectively cause your search not to run (at all) if nothing is checked, as the token would be unset, and hence the search would think it needs to wait for input (until the token is set).

varun99
Path Finder

I just tried with the Dropdown and it worked. Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...