Splunk Search
Highlighted

Repeating control in form?

Communicator

Hey all,

I was poking around doing a custom form and, since there are no checkbox controls that I can find, came up with the idea of using a repeating dropdown. I have a list of terms that may or may not be in the events I am searching--Term1, Term2, Term3.

I was thinking something like the following:


Term1 |{v} Yes     |

Term2 |{v} No       |

Term3 |{v} Maybe |

Term1's value would be " AND mytag=Term1"
Term2's value would be " AND NOT mytag=Term2"
Term3's value would be " " or blank -- it could appear or not

So that the search would be "source=mysource mysearchstuff AND mytag=Term1 AND NOT mytag=Term2 ". I can get the repeating list, I think--but I don't know about the dropdown.

Any ideas or is this just too far out there?

Thanks!

0 Karma
Highlighted

Re: Repeating control in form?

Builder

Hello. Check out Nick's sideview utils app on splunkbase. It adds several new modules for use, one of them being a checkbox module that will allow you to do just this. You'll be able to assign each checkbox a value that when clicked will be inserted into a search.

Sideview

0 Karma
Highlighted

Re: Repeating control in form?

Communicator

To be honest, I was trying to get around the lack of checkboxes with the dropdowns. Do you know if the checkboxes can be dynamic--fed from a lookup query?

0 Karma