How to change the default behavior for checkboxes so it searches with OR for multiple selections, not AND?

[brywilk_umich]

Hi All,

The default behavior when building a dashboard with checkboxes is that the checkboxes equal an AND search. Is there a way to change the behavior to be OR?

For example, I have ten checkboxes index1 index2 index3....... When I do the checkboxes (and choose 2) the search comes out to be "index=1 index=7". I would like it to be "index=1 OR index=7"

thank you,
-Bryan

[masonmorales · Accepted solution]

Edit the SimpleXML for the checkbox input and change the delimiter to OR

<fieldset>
  <input type="checkbox" token="yourtoken">
    <choice value="1">One</choice>
    <choice value="2">Two</choice>
    <choice value="3">Three</choice>
    <delimiter> OR </delimiter>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <valuePrefix>index="</valuePrefix>
    <valueSuffix>"</valueSuffix>
  </input>
</fieldset>

Docs: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML