Splunk Search

How to set up radio button or checkbox to alter text search?

raborder
New Member

I'd like to use a radio button or checkbox to alter a search
i.e. toggle between either

Index=$index$ host=$host$ source=$source$

or

Index=$index$ host=$host$ source=$source$ **NOT INFO**

I cannot find a simple way to do this, I find radio buttons will not uncheck, and leaving an option blank gets me an undefined search etc.

Is there a way to do this?

Tags (4)
0 Karma
1 Solution

renjith_nair
Legend

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
---
What goes around comes around. If it helps, hit it with Karma 🙂

raborder
New Member

Awesome Renjith. This works as I want. I'll go over it and work out why my solution didn't 🙂

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...