Splunk Search

How to set up radio button or checkbox to alter text search?

raborder
New Member

I'd like to use a radio button or checkbox to alter a search
i.e. toggle between either

Index=$index$ host=$host$ source=$source$

or

Index=$index$ host=$host$ source=$source$ **NOT INFO**

I cannot find a simple way to do this, I find radio buttons will not uncheck, and leaving an option blank gets me an undefined search etc.

Is there a way to do this?

Tags (4)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@raborder,

Try this example with radio button
- First option searches internal index for all log levels including INFO
- Second option searches internal index for all log levels excluding INFO

<form>
  <label>Search Switch</label>
  <fieldset submitButton="false">
    <input type="radio" token="search_tok">
      <label>Select the search</label>
      <choice value="">Include INFO</choice>
      <choice value="NOT &quot;INFO&quot;">Exclude INFO</choice>
      <default></default>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_* $search_tok$|stats count by log_level</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>
Happy Splunking!

raborder
New Member

Awesome Renjith. This works as I want. I'll go over it and work out why my solution didn't 🙂

0 Karma
Get Updates on the Splunk Community!

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...

Cloud Platform | Migrating your Splunk Cloud deployment to Python 3.7

Python 2.7, the last release of Python 2, reached End of Life back on January 1, 2020. As part of our larger ...