How to exclude results using checkbox?

[tomapatan]

I have the following search which returns a table of all hostnames and operating systems.

| inputlookup hosts.csv
| search OS="*server*"
| table hostname, OS

I would like to add a checkbox to exclude Windows Server 2008 builds. This is what I have so far:

<row>
<panel>
<input type="checkbox" token="checkbox" searchWhenChanged="true">
<label></label>
<choice value="Windows Server 2008*">Exclude Server 2008</choice>
<change>
<condition match="$checkbox$==&quot;Enabled&quot;">
<set token="setToken">1</set>
</condition>
<condition>
<unset token="setToken"></unset>
</condition>
</change>
</input>
</panel>
</row>

New panel to show server builds depending on the checkbox:

<query>

| inputlookup hosts.csv
| search OS="*server*" AND OS!="$checkbox$"
| stats count as total

<query>

This only works when the checkbox is selected and correctly excludes the 2008 builds from the search, but doesn`t display anything when the checkbox is unselected. I would like to display all devices when the  checkbox is unselected.

[tomapatan]

Thanks Paul, unfortunately it now does the opposite as before: displays correctly when the checkbox is selected and no content when it`s checked.

[PaulPanther]

Just use below test dashboard  for verification. There might be something wrong in your search or in the input config. Feel free to share your code.

<form version="1.1">
  <label>Test_checkbox</label>
  <fieldset submitButton="false"></fieldset>
  <row>
    <panel>
      <input type="checkbox" token="checkbox" searchWhenChanged="true">
        <label></label>
        <choice value="Windows Server 2008*">Exclude Server 2008</choice>
        <delimiter> </delimiter>
        <change>
          <condition label="Exclude Server 2008">
            <set token="tokenFilter">AND OS!="Windows Server 2008*"</set>
          </condition>
          <condition>
            <set token="tokenFilter"></set>
          </condition>
        </change>
      </input>
    </panel>
  </row>
  <row>
    <panel>
      <event>
        <search>
          <query>index=_internal OS="*server*" $tokenFilter$
| stats count as total</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="list.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </event>
    </panel>
  </row>
</form>

[PaulPanther · Accepted solution]

  <row>
    <panel>
      <input type="checkbox" token="checkbox" searchWhenChanged="true">
        <label></label>
        <choice value="Windows Server 2008*">Exclude Server 2008</choice>
        <delimiter> </delimiter>
        <change>
          <condition label="Exclude Server 2008">
            <set token="tokenFilter">AND OS!="Windows Server 2008*"</set>
          </condition>
          <condition>
            <set token="tokenFilter"></set>
          </condition>
        </change>
      </input>
    </panel>
  </row>

and adjust your search like

| inputlookup hosts.csv
| search OS="*server*"  $tokenFilter$
| stats count as total

[tomapatan]

Thanks Paul,

I made the mistake of encapsulating $tokenFilter$ in double quotes. Works fine without the quotes.