Hello, I have a dashboard with checkbox and input field. If you choose the group and type 'something' into to the text input the search is looking for category="something" If you choose the ...
See more...
Hello, I have a dashboard with checkbox and input field. If you choose the group and type 'something' into to the text input the search is looking for category="something" If you choose the Any field the search is looking for "something". I want to set that if I choose the Any field the search does not add this tag: "", only search for something. But of course remain the tag with other checkbox selection, like category="something". The main goal would be I'd like to free to use the Any field option. So now if I type e.g. something OR anything, the search does not understand correctly because it looks like "something OR anything", so it detect like one variable. So I like to see something OR anything. Could you please help to modify my dashboard? <form version="1.1" theme="light">
<label>Multiselect Text</label>
<init>
<set token="toktext">*</set>
</init>
<fieldset submitButton="false">
<input type="checkbox" token="tokcheck">
<label>Field</label>
<choice value="Any field">Any field</choice>
<choice value="category">Group</choice>
<choice value="severity">Severity</choice>
<default>category</default>
<valueSuffix>=REPLACE</valueSuffix>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<change>
<eval token="form.tokcheck">case(mvcount('form.tokcheck')=0,"category",isnotnull(mvfind('form.tokcheck',"Any field")),"Any field",1==1,'form.tokcheck')</eval>
<eval token="tokcheck">if('form.tokcheck'="Any field","REPLACE",'tokcheck')</eval>
<eval token="tokfilter">replace($tokcheck$,"REPLACE","\"".$toktext$."\"")</eval>
</change>
</input>
<input type="text" token="toktext">
<label>Value</label>
<default>*</default>
<change>
<eval token="tokfilter">replace($tokselect$,"REPLACE","\"".$toktext$."\"")</eval>
</change>
</input>
</fieldset>
<row>
<panel>
<event>
<title>$tokfilter$</title>
<search>
<query>index=* $tokfilter$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="refresh.display">progressbar</option>
</event>
</panel>
</row>
</form> Thank you very much in advance!