How to pass token during check and uncheck of the checkbox?

[vivek_manoj]

How to pass token during check and uncheck of the checkbox in splunk? For ex- if I check the box then it will pass the token to the textbox and if we unclick then it will pass NULL to it.
So, that we can use the value of textbox in the table using token.

[niketn]

@vivek_manoj, when you ask NULL, you would need to add more detail with the value you are expecting

In Splunk

Option 1) unset token implies no value: i.e. <unset token="exclude"></unset> will result in $exclude$=$exclude$
Option 2) set token can set value to string "NULL" i.e. <set token="exclude">NULL</set> will result in $exclude$="NULL"
Option 3) set token can set value to empty string "" i.e. <set token="exclude"></set> will result in $exclude$=""

I think by NULL you are actually looking at option 3.

As @martin_mueller , has pointed out there is no need to keep all form tokens to same name exclude as it will be confusing for you and your dashboard. If you want to link checkbox with textbox you can code the <change> event handler for either or both.

Your complete Dashboard code is really confusing and you should either check with your Business for expected Rules/Use Case or even better Splunk SME or Splunk Admin.
1) Radio button seems redundant

2) Your Check Box and Text Box are linked but Check Box accepts only two values "Reassigned" or Empty i.e. ( "" ). What if user changes Text Box value to "Closed" etc. how should check box behave?

3) Your search filter is being applied in third pipe, where as it should be in base search.
The behavior is something like following:

1st Filter (Base Search with Macro): "Closed", "Open", "Closed", "Reassigned", "", "Open", "Closed","" 
2nd Filter (Dedup with current_ticket_state): Closed", "Open", "Reassigned", "" 
3rd Filter (NOT current_ticket_state="Reassigned"): "Closed", "Open", ""

If you apply your search filter in Base Search you will have only results you are looking for. Refer to Splunk Documentation : http://docs.splunk.com/Documentation/Splunk/latest/Search/Quicktipsforoptimization#Be_specific

Not sure what is exactly your requirement, however,
if it is to find Reassigned tickets on checkbox click your final search should be

`itsm_ticketanalysis_index(main)` current_ticket_state="Reassigned"
| dedup current_ticket_state
| table current_ticket_state

Or vice versa if the check box is unchecked then

`itsm_ticketanalysis_index(main)` current_ticket_state!="Reassigned"
| dedup current_ticket_state
| table current_ticket_state

Notice your search query is pushed back into base search.

4) Evaluate whether you need NOT or !=, as both will give different results and performance is better with !=. Refer to Splunk Documentation: http://docs.splunk.com/Documentation/Splunk/latest/Search/NOTexpressions
You should in fact see how many distinct values you have for current_ticket_state using <YourBaseSearch>| dedup current_ticket_state| table current_ticket_state. If there are only handful such status your are better off performing INCLUSION (OR) rather than EXCLUSION (NOT). Refer to documentation : http://dev.splunk.com/view/dev-guide/SP-CAAAE3B

Having said all this if you are just using Check box and Text Box, you can try the following code as per what you had requested in your question:

<input type="checkbox" token="chkexclude" searchWhenChanged="true">
  <label>Exclude/Include</label>
  <default>Reassigned</default>
  <initialValue>Reassigned</initialValue>
  <choice value="Reassigned">Reassigned</choice>
  <change>
    <condition value="Reassigned">
      <set token="form.txtExclude">$value$</set>
      <set token="exclude">$value$</set>
    </condition>
    <condition>
      <set token="form.txtExclude"></set>
      <set token="exclude"></set>
    </condition>
  </change>
</input>
<input type="text" searchWhenChanged="true" token="txtExclude">
  <label>Manual Override</label>
  <initialValue>Reassigned</initialValue>
  <change>
    <condition value="Reassigned">
      <set token="form.chkExclude">Reassigned</set>
      <set token="exclude">$value$</set>
    </condition>
    <condition>
      <set token="form.chkExclude"></set>
      <set token="exclude"></set>
    </condition>
  </change>
</input>

As you can see I have coded change event of the inputs to pass on value from one input to other and also to a common token. Ideally you should have Check box as first level of filter and Text Box as override. That way only Text Box sets the final token for Search query and User changes flow in only one direction. However, this would actually be based on your use case.
Another reason why your dashboard is confusing is because the final query which you are running performs a dedup on current_ticket_state and puts only that field in the table. This does not seem useful. You can actually create your Checkbox with similar query to populate all Status and then show Transaction status in Table for various Status selected (You will not need Text Box as all available Status will be present in Checkbox).

Please do confirm the clear requirement for the community to assist you better.

[kyaparla]

This works for check box, it can set 2 different values for check and uncheck of a checkbox.

<input type="checkbox" token="toggle" searchWhenChanged="true">
  <label>toggle</label>
  <choice value="toggle checked">True</choice>
  <default>toggle unchecked</default>
   <change>
     <condition match="isnull($toggle$)">
       <set token="toggle">toggle unchecked</set>
     </condition>
   </change>
</input>

[nick405060]

I downvoted this post because this does not work setting an initialValue. There are much more robust solutions out there.

[kkrishnan_splun]

isnull($$) in the conditional match totally resolved an issue of mine. Upvoted !!! Thank you so much 🙂

[cmerriman]

use this. it will unset your token, so when it is checked, the panel will show with the depends="$exclude$" and will not show when it is unchecked. just make sure the second input you have listed above (type=text) changes token values, you shouldn't have two inputs with the same token.

 <input type="checkbox" token="exclude" searchWhenChanged="true">
      <label>Exclude/Include</label>
      <default>Reassigned</default>
      <choice value="Reassigned">Reassigned</choice>
      <change>
        <condition value="Reassigned">
          <unset token="exclude"></unset>
        </condition>
      </change>

[vivek_manoj]

Thanks cmerrriman.

Its not working.

Actually I want when I click the checkbox button then the value "Reassigned" passed to textbox and when we uncheck it then NULL value passed to textbox. then only we are able to get the table. As table is getting the token from textbox. Below is the whole code of dashboard. Please help. Its urgent.

<dashboard>
  <label>Reassigned</label> 
  <fieldset submitButton="false">    
    <input type="checkbox" token="exclude" searchWhenChanged="true">
      <label>Exclude/Include</label>
      <default>Reassigned</default>
      <initialValue>Reassigned</initialValue>
      <choice value="Reassigned">Reassigned</choice>
    </input>  
    <input type="text" searchWhenChanged="true" token="exclude">
      <label>field1</label>
      <initialValue>Reassigned</initialValue>
    </input>

    <input type="radio" token="exclude">
      <label>field1</label>
      <choice value="Reassigned">Include</choice>
      <choice value="">Exclude</choice>
    </input>

  </fieldset>
  <row>

    <panel>
      <table>
        <search>
          <query>`itsm_ticketanalysis_index(main)`| dedup current_ticket_state|search NOT (current_ticket_state="$exclude$")| table current_ticket_state</query>
          <earliest>0</earliest>
          <latest></latest>
        </search>
        <option name="wrap">true</option>
        <option name="rowNumbers">false</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">cell</option>
        <option name="count">10</option>
      </table>
    </panel>
  </row>
</dashboard>

[martin_mueller]

I see you have two inputs, both setting the token exclude - is that intentional? If so, why?

I'm not sure if that's supported.

[vivek_manoj]

Yeah, Its intentional, as we click on the checkbox then its value is send to textbox. and to receive the value we need same token in both the places.

[niketn]

@vivek_manoj, can you add the content of current check box that you have?

[vivek_manoj]

<input type="checkbox" token="exclude" searchWhenChanged="true">
      <label>Exclude/Include</label>
      <default>Reassigned</default>
      <initialValue>Reassigned</initialValue>
      <choice value="Reassigned">Reassigned</choice>
    </input>

    <input type="text" searchWhenChanged="true" token="exclude">
      <label>field1</label>
      <initialValue>Reassigned</initialValue>
    </input>

In this one is checkbox that is passing the value to textbox while checking it but will unchecking its sending nothing. It should be NULL so that I can use the token exclude in table.