Splunk Search

How to set up radio button or checkbox to alter text search?

raborder
New Member

I'd like to use a radio button or checkbox to alter a search
i.e. toggle between either

Index=$index$ host=$host$ source=$source$

or

Index=$index$ host=$host$ source=$source$ **NOT INFO**

I cannot find a simple way to do this, I find radio buttons will not uncheck, and leaving an option blank gets me an undefined search etc.

Is there a way to do this?

Tags (4)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

raborder
New Member

Awesome Renjith. This works as I want. I'll go over it and work out why my solution didn't 🙂

0 Karma
Get Updates on the Splunk Community!

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...

Starting With Observability: OpenTelemetry Best Practices

Tech Talk Starting With Observability: OpenTelemetry Best Practices Tuesday, October 17, 2023   |  11AM PST / ...

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW! Every day the list of sources Admins are responsible for gets bigger and bigger, often making ...