Splunk Search

Is it possible to put a Checkbox (YES/NO) in order to let the user choose whether or not to apply drop-down input choices (addinput)?

skender27
Contributor

Hi,

I have an addinput drop-down selection which applies to my dashboard (as a token).
Is it possible to put a Checkbox (YES/NO) in order to let the user choose whether or not to apply the drop-down choices?
In the sense that if you choose NO, the choices of the drop-down menu are useless and do not apply to the search string...

Thanks,
Skender

0 Karma

somesoni2
Revered Legend

It depends on how your dropdown selection is used in panel searches. You can have a checkbox with a default value and panel search will have a subsearch to apply dropdown filter based on checkbox value.

A run anywhere sample dashboard is here.

<form>
  <label>ConditionalFilter</label>
  <fieldset submitButton="false">
    <input type="checkbox" searchWhenChanged="true" token="applyFilter">
      <label></label>
      <choice value="1">Apply Filter</choice>
      <default>0</default>
    </input>
    <input type="dropdown" searchWhenChanged="true" token="sourcetype">
      <label>Select Sourcetype</label>
      <choice value="splunkd">splunkd</choice>
      <choice value="scheduler">scheduler</choice>
      <choice value="splunkd_ui_access">splunkd_ui_access</choice>
      <default>splunkd</default>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal [| gentimes start=-1 | eval sourcetype=if(replace("$applyFilter$",".*(\d)","\1")="1","$sourcetype$","*") | table sourcetype]| timechart  count by sourcetype</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">column</option>        
      </chart>
    </panel>
  </row>
</form>

skender27
Contributor

Hi,

It is exactly what i need.
The dropdown uses a token field and has some static options selections key=value and by default I need it to be appliable (YES check).
If I select the NO checkbox, the dropdown selections (so the token field) ahs no effect at all to the search string.

Should I do this by modifying the xml or by web interface?

Thanks,
Skender

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...