Splunk Search

Checkbox usage in splunk dashboard

bharathkumarnec
Contributor

Hi All,

I am using 5 checkboxes and when i select any of the checkbox then only corresponding chart will be visible, challenge here is even though i select the checkbox or not, query for all the 5 checkboxes are running backend.

So checkbox is only giving me the option of hide & visibility.

Kindly help me out if this is the purpose of the checkbox and also is there anyway that only when selected a chart query has to run.

Regards,
BK

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @bharathkumarnec,

Can you please try this dashboard XML?

<form>
  <label>Search on click of Check Box </label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tkn_chk1">
      <label>Check box 1</label>
      <choice value="true">Chk1</choice>
      <change>
        <condition value="true">
          <set token="chkA"></set>
        </condition>
        <condition value="*">
          <unset token="chkA"></unset>
        </condition>
      </change>
    </input>
    <input type="checkbox" token="tkn_chk2">
      <label>Check box 2</label>
      <choice value="true">Chk2</choice>
      <change>
        <condition value="true">
          <set token="chkB"></set>
        </condition>
        <condition value="*">
          <unset token="chkB"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$chkA$">
      <table>
        <title>Panel 1</title>
        <search>
          <query>index=_internal  $chkA$ | stats count by sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$chkB$">
      <table>
        <title>Panel 2</title>
        <search>
          <query>index=_internal  $chkB$ | stats count by source</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

bharathkumarnec
Contributor

So how will be the token $chkA$ & $chkB$ will take affect to my queries??

0 Karma

micahkemp
Champion

You can use some trickery to accomplish what you're looking for.

Try having your checkbox set a value that is essentially a "no-op" in your search. For example, if your panel runs a typical indexed search like index=main sourcetype=firewall src=$src$ dest=$dest$, you could have your checkbox set its value to the implied search command. The search would then look like this: $checkbox$ index=main sourcetype=firewall src=$src$ dest=$dest$. When your checkbox is selected the $checkbox$ token will get replaced with the search command and the search will kick off.

The key to having the search not running in the background is to make sure that the query contains a token that isn't defined until your checkbox is selected.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...