Splunk Search

Checkbox usage in splunk dashboard

bharathkumarnec
Contributor

Hi All,

I am using 5 checkboxes and when i select any of the checkbox then only corresponding chart will be visible, challenge here is even though i select the checkbox or not, query for all the 5 checkboxes are running backend.

So checkbox is only giving me the option of hide & visibility.

Kindly help me out if this is the purpose of the checkbox and also is there anyway that only when selected a chart query has to run.

Regards,
BK

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @bharathkumarnec,

Can you please try this dashboard XML?

<form>
  <label>Search on click of Check Box </label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tkn_chk1">
      <label>Check box 1</label>
      <choice value="true">Chk1</choice>
      <change>
        <condition value="true">
          <set token="chkA"></set>
        </condition>
        <condition value="*">
          <unset token="chkA"></unset>
        </condition>
      </change>
    </input>
    <input type="checkbox" token="tkn_chk2">
      <label>Check box 2</label>
      <choice value="true">Chk2</choice>
      <change>
        <condition value="true">
          <set token="chkB"></set>
        </condition>
        <condition value="*">
          <unset token="chkB"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$chkA$">
      <table>
        <title>Panel 1</title>
        <search>
          <query>index=_internal  $chkA$ | stats count by sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$chkB$">
      <table>
        <title>Panel 2</title>
        <search>
          <query>index=_internal  $chkB$ | stats count by source</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

bharathkumarnec
Contributor

So how will be the token $chkA$ & $chkB$ will take affect to my queries??

0 Karma

micahkemp
Champion

You can use some trickery to accomplish what you're looking for.

Try having your checkbox set a value that is essentially a "no-op" in your search. For example, if your panel runs a typical indexed search like index=main sourcetype=firewall src=$src$ dest=$dest$, you could have your checkbox set its value to the implied search command. The search would then look like this: $checkbox$ index=main sourcetype=firewall src=$src$ dest=$dest$. When your checkbox is selected the $checkbox$ token will get replaced with the search command and the search will kick off.

The key to having the search not running in the background is to make sure that the query contains a token that isn't defined until your checkbox is selected.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...