I have a search in splunk that uses the predict function that looks something like:
index=core ...$token1$ | fields - upper* lower*
This basically creates a chart that I have other tokens/inputForms being used to control the chart (e.g. timespan, granularity, elements...)
So I want to be able to toggle the search between this:
index=core ...$token1$ |
and this:
index=core ...| fields - upper* lower*
I am thinking I can do something like this:
<input type="radio" token="toggle" searchWhenChanged="true">
<label>Toggle On/Off:</label>
<default>On</default>
<choice value="fields - upper* lower*">On</choice>
<choice value="">Off</choice>
</input>
with my search looking like:
index=core ...$token1$ | fields - upper* lower*
and then the On will give index=core ...$token1$ | fields - upper* lower*
and the Off will give index=core ...$token1$ |
Hmm this seems logical will see how I go
It worked first time 🙂
this actually worked 🙂