Splunk Search

Check box for base search

prajwal_94
Explorer

Hi guys,

For a dashboard panel, I am running base search and hoping to have a checkbox that returns the timechart data while selecting the check box. Not sure what changes needs to be done to the following query- (also I guess the tag placement for row, panel & chart needs to be aligned)


<search id="base_search">
<query>index=magic host="abc*" $check1$</query>
<earliest>-120m@m</earliest>
<latest>now</latest>
</search>
<fieldset submitButton="false">
<input type="checkbox" token="check1" searchWhenChanged="true">
<label>box</label>
<choice value="*">All</choice>
<search base="base_search">
<query>| search "abracadabra" | timechart span=5m count
</query>
</search>
<fieldForLabel>check1</fieldForLabel>
<fieldForValue>check1</fieldForValue>
</input>
</fieldset>

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The input search won't run until the token in the base search is defined - which won't happen until the input search runs.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and stall ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...