Splunk Search

How to exclude results using checkbox?

tomapatan
Communicator

I have the following search which returns a table of all hostnames and operating systems.

| inputlookup hosts.csv
| search OS="*server*"
| table hostname, OS

I would like to add a checkbox to exclude Windows Server 2008 builds. This is what I have so far:

<row>
<panel>
<input type="checkbox" token="checkbox" searchWhenChanged="true">
<label></label>
<choice value="Windows Server 2008*">Exclude Server 2008</choice>
<change>
<condition match="$checkbox$==&quot;Enabled&quot;">
<set token="setToken">1</set>
</condition>
<condition>
<unset token="setToken"></unset>
</condition>
</change>
</input>
</panel>
</row>

 

New panel to show server builds depending on the checkbox:

<query>

| inputlookup hosts.csv
| search OS="*server*" AND OS!="$checkbox$"
| stats count as total

<query>

This only works when the checkbox is selected and correctly excludes the 2008 builds from the search, but doesn`t display anything when the checkbox is unselected. I would like to display all devices when the  checkbox is unselected.

0 Karma
1 Solution

PaulPanther
Motivator
  <row>
    <panel>
      <input type="checkbox" token="checkbox" searchWhenChanged="true">
        <label></label>
        <choice value="Windows Server 2008*">Exclude Server 2008</choice>
        <delimiter> </delimiter>
        <change>
          <condition label="Exclude Server 2008">
            <set token="tokenFilter">AND OS!="Windows Server 2008*"</set>
          </condition>
          <condition>
            <set token="tokenFilter"></set>
          </condition>
        </change>
      </input>
    </panel>
  </row>

and adjust your search like

| inputlookup hosts.csv
| search OS="*server*"  $tokenFilter$
| stats count as total

View solution in original post

0 Karma

tomapatan
Communicator

Thanks Paul, unfortunately it now does the opposite as before: displays correctly when the checkbox is selected and no content when it`s checked.

0 Karma

PaulPanther
Motivator

Just use below test dashboard  for verification. There might be something wrong in your search or in the input config. Feel free to share your code.

 

<form version="1.1">
  <label>Test_checkbox</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="checkbox" token="checkbox" searchWhenChanged="true">
        <label></label>
        <choice value="Windows Server 2008*">Exclude Server 2008</choice>
        <delimiter> </delimiter>
        <change>
          <condition label="Exclude Server 2008">
            <set token="tokenFilter">AND OS!="Windows Server 2008*"</set>
          </condition>
          <condition>
            <set token="tokenFilter"></set>
          </condition>
        </change>
      </input>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal OS="*server*" $tokenFilter$
| stats count as total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>

 

0 Karma

PaulPanther
Motivator
  <row>
    <panel>
      <input type="checkbox" token="checkbox" searchWhenChanged="true">
        <label></label>
        <choice value="Windows Server 2008*">Exclude Server 2008</choice>
        <delimiter> </delimiter>
        <change>
          <condition label="Exclude Server 2008">
            <set token="tokenFilter">AND OS!="Windows Server 2008*"</set>
          </condition>
          <condition>
            <set token="tokenFilter"></set>
          </condition>
        </change>
      </input>
    </panel>
  </row>

and adjust your search like

| inputlookup hosts.csv
| search OS="*server*"  $tokenFilter$
| stats count as total
0 Karma

tomapatan
Communicator

Thanks Paul,

I made the mistake of encapsulating $tokenFilter$ in double quotes. Works fine without the quotes.

0 Karma
Get Updates on the Splunk Community!

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL

Splunk AI Assistant for SPL | Key Use Cases to Unlock the Power of SPL  The Splunk AI Assistant for SPL ...

Buttercup Games: Further Dashboarding Techniques (Part 5)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Customers Increasingly Choose Splunk for Observability

For the second year in a row, Splunk was recognized as a Leader in the 2024 Gartner® Magic Quadrant™ for ...