Splunk Search

How to set up radio button or checkbox to alter text search?

raborder
New Member

I'd like to use a radio button or checkbox to alter a search
i.e. toggle between either

Index=$index$ host=$host$ source=$source$

or

Index=$index$ host=$host$ source=$source$ **NOT INFO**

I cannot find a simple way to do this, I find radio buttons will not uncheck, and leaving an option blank gets me an undefined search etc.

Is there a way to do this?

Tags (4)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

raborder
New Member

Awesome Renjith. This works as I want. I'll go over it and work out why my solution didn't 🙂

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...