Search a yes/no field with a single checkbox token

[altink]

Dear All,

I have a YES/NO field named "FIELD2" which I want to search with a single checkbox token named "Checkbox1" , in the following way:

Checkbox1.checked = TRUE   
search:  index=db FIELD1= FIELD2="YES"

Checkbox2.checked = FALSE  
search:  index=db FIELD1= FIELD2="*"
or better
search:  index=db FIELD1=

I tried with condition and match but no result.

Can someone advise "from scratch"?

best regards
Altin

[Vijeta]

Hi,

I copied your code and when you check the box , the token2= SELECT and when you uncheck the box token2=*.

replace the in your panel with and see what you get.

Also try using ACTION_NAME="$token2$" instead of $token2$

Thanks
Vijeta

[altink]

thank you for the answer,

but I am not getting what you are saying above.
What should I replace with what?
What is the point of ACTION_NAME="$token2$"?

can you clearly indicate what's wrong with my code above?

best regards
Altin

[Vijeta]

There is nothing wrong in your code , its working perfect when i tried.

just in the title tag, instead of <title>Records</title> use

<title>$token2$</title>

to see the behaviour of the checkbox. I tried and its working as needed.

[altink]

I did,
and it shows SELECT - when Checkbox not checked; * - when Checkbox checked

[altink]

In the code below, I have all records when the SELECT-Only is checked, and only the SELECT-s when not checked - reverse behavior.
The ACTION_NAME fields values can be SELECT, INSERT, DELETE, UPDATE...... typical DB actions.

<form>
  <label>Test 022</label>

 <fieldset submitButton="false">
    <input type="time" token="field_time">
      <label>Time</label>
      <default>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </default>
    </input>

    <input type="dropdown" token="field_db_name" searchWhenChanged="true">
      <label>Database</label>
      <prefix>"</prefix>
      <suffix>"</suffix>
      <default>*</default>
      <fieldForLabel>LMS_DB_NAME</fieldForLabel>
      <fieldForValue>LMS_DB_NAME</fieldForValue>
      <search>
        <query>index=omega_ca | DEDUP LMS_DB_NAME | FIELDS LMS_DB_NAME</query>
      <earliest>$field_time.earliest$</earliest>
      <latest>$field_time.latest$</latest>
      </search>
    </input>

    <input type="checkbox" token="checkbox1" searchWhenChanged="true">
      <label>SELECT-Only</label>
      <choice value="SELECT">On</choice>
      <change>
        <condition match="$checkbox1$==&quot;SELECT&quot;">
          <eval token="token2">"SELECT"</eval>
          <!--<unset token="checkbox1"></unset>-->
        </condition>
        <condition>
          <eval token="token2">"*"</eval>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>

  </fieldset>
  <row>
    <panel>
      <title>Records</title>
      <table>
        <search>
          <query>index=omega_ca | search LMS_DB_NAME=$field_db_name$ ACTION_NAME=$token2$ 
          | table _time, USERNAME, LMS_DB_NAME, LMS_DB_HOST, ACTION_NAME</query>
        <earliest>$field_time.earliest$</earliest>
        <latest>$field_time.latest$</latest>
        </search>
        <option name="count">16</option>
        <option name="rowNumbers">true</option>
        <option name="wrap">false</option>

      </table>
    </panel>
  </row>
</form>

best regards
Altin

[Vijeta]

Hi @altink

Since its working for me, I am curious to know why same code doesn't work for you.
Can you please copy your complete dashboard code here?

Thanks
Vijeta

[Dawson014]

Hi Altin,

Please try out the solution below -

<form>
  <label>splunk.answers tryouts</label>
  <init>
    <set token="search_token">FIELD2="*"</set>
  </init>
  <fieldset submitButton="false" autoRun="true">
    <input type="checkbox" searchWhenChanged="true" token="checkbox1">
      <label>toggle</label>
      <choice value="YES">On</choice>
      <change>
        <condition match="$checkbox1$==&quot;YES&quot;">
          <set token="search_token">FIELD2="*"</set>
        </condition>
        <condition>
          <set token="search_token">FIELD2="YES"</set>
        </condition>
      </change>
      <delimiter> </delimiter>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=db $search_token$</query>
          <earliest>-1m</earliest>
          <latest></latest>
        </search>
      </table>
    </panel>
  </row>
</form>

This is working as intended for me.
Just substitute the search query with yours. Let me know if this does not work.

[altink]

Your code did work. I made a small change on my own, removed the field present in values and left it only in the search.

   <init>
     <set token="search_token">"*"</set>
   </init>

............................................................................

      <input type="checkbox" searchWhenChanged="true" token="checkbox1">
       <label>toggle</label>
       <choice value="YES">On</choice>
       <change>
         <condition match="$checkbox1$==&quot;YES&quot;">
           <set token="search_token">"*"</set>
         </condition>
         <condition>
           <set token="search_token">"YES"</set>
         </condition>
       </change>
       <delimiter> </delimiter>
     </input>

............................................................................

index=...... | FIELD2 = $search_token$

However, I can see (correct me) that you have switched the places in the assignment of the Value to YES or *, according to checkbox chosen or not. What I see

         <condition match="$checkbox1$==&quot;YES&quot;">
           <set token="search_token">"*"</set>
         </condition>

is that you are assigning the * when the value is YES (checked), and vise-versa. This is exactly the point we did stop at the previous (not yours) replies - and it is the answer I am looking for.

The code really works, but (for me) against what is expected to do, and if I (or other people) will look at that part of code after a few time, it will by sure prompt for correction.

Please advise
Altin

[Dawson014]

Hi,

Have you tried using radiobutton, per you requirement I think the radiobutton is well suited for the job.
By default the radiobutton will be off, and FIELD2=* will work. When you click the on button, FIELD="YES" will be there. Take a look at the code below -

<input type="radio" token="checkbox1" searchWhenChanged="true">
      <label>toggle</label>
      <choice value="YES">On</choice>
      <choice value="*">Off</choice>          
      <prefix>FIELD2="</prefix>
      <default>*</default>
      <suffix>"</suffix>
      <initialValue>*</initialValue>
    </input>

The query will be like

index=your_index $checkbox1$

Here's a screenshot for you reference -


Let me know if this helps.

[altink]

Thank you very much @Dawson014,
but this question was raised for a single Checkbox solution only,
which by sure is no rocket science, but it seems to be painful here in Splunk.

[Vijeta]

Hi,
Try with these conditions for checkbox,

YES
NO

Also in your search use FIELD=$checkbox_tokenname$

[altink]

Thank you very much for the reply.

to explain better,
below is the code of my checkbox:

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
      <label>toggle</label>
      <choice value="YES">On</choice>
      <change>
        <condition match="$checkbox1$==&quot;YES&quot;">
          <set token="token2">"YES"</set>
        </condition>
        <condition>
          <set token="token2">"*"</set>
        </condition>
      </change>
    </input>

and the search is like

index=.... FIELD2= $token2$

Initially when it opens, the search is made with FIELD2= "*".
When I first check the checkbox - id does not search. Or better said - it is searching the same (all), thus no movement in the page.
Checking and unchecking later will work - but in the opposite expected result.
When Checked - all results YES/NO come out - I was expecting only YES.
When unchecking - only the YES come out - I was expecting both.

best regards
Altin

[Vijeta]

Instead of using condition tags, you can use below if it helps

On

and the token for checkbox i.e. checkbox1 can be used in search like
index=.... FIELD2= "$checkbox1$"

Please check if it needs to be in quotes or not, see the value of checkbox token in URL when dashboard loads.

[altink]

I have tried that (using the same chekbox-es token), but it doesn't work.

regards
Altin

[altink]

I have done what I need with a Dropdown as below:

<input type="dropdown" token="field2">
      <label>Effective User</label>
      <default>*</default>
      <prefix>"</prefix>
      <suffix>"</suffix>
      <choice value="YES">On</choice>
      <choice value="*">Off</choice>
    </input>

and the search is:

... | search ......... CURR_USER=$field2$

What I need is to to the same, but with a Checkbox, not a Dropdown

best regards
Altin

[Vijeta]

Hi,

I was able to do with the checkbox, similar code to what you have done. See the code below, it works fine for me.

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
  <label></label>
  <choice value="YES">On</choice>
  <change>
    <condition match="$checkbox1$==&quot;YES&quot;">
      <eval token="token2">"YES"</eval>
      <!--<unset token="checkbox1"></unset>-->
    </condition>
    <condition>
      <eval token="token2">"*"</eval>
    </condition>
  </change>
  <delimiter> </delimiter>
  <default>YES</default>
  <initialValue>YES</initialValue>
</input>

[altink]

It works in the opposite, not the way I am looking for.
Checked - shows All
Unchecked - shows only YES

best regards
Altin

[Vijeta]

Hi,
This is happening only when dashboard is initially loaded, once you click on the checkbox the token sets appropriately.
I removed the default and initiaValue options for my checkbox, and now on refreshing the dashboard the initial value of checkbox is unchecked and token value is *, on checking the box the token value is changing to Yes and again on unchecking to * which is as expected.
It works perfect for me.

Thanks
Vijeta

[altink]

thank you very much for following this.

but I have the same result (opposite behavior), even after removing lines as suggested

<input type="checkbox" token="checkbox1" searchWhenChanged="true">
   <label></label>
   <choice value="YES">On</choice>
   <change>
     <condition match="$checkbox1$==&quot;YES&quot;">
       <eval token="token2">"YES"</eval>
       <!--<unset token="checkbox1"></unset>-->
     </condition>
     <condition>
       <eval token="token2">"*"</eval>
     </condition>
   </change>
   <delimiter> </delimiter>
 </input>

best regards
Altin

[Vijeta]

How are you checking the value of token2? It would be good if you can diaplay token2 value on the panel and verify the behavior of tokens.