Splunk Search

How to change the default behavior for checkboxes so it searches with OR for multiple selections, not AND?

brywilk_umich
Path Finder

Hi All,

The default behavior when building a dashboard with checkboxes is that the checkboxes equal an AND search. Is there a way to change the behavior to be OR?

For example, I have ten checkboxes index1 index2 index3....... When I do the checkboxes (and choose 2) the search comes out to be "index=1 index=7". I would like it to be "index=1 OR index=7"

thank you,
-Bryan

0 Karma
1 Solution

masonmorales
Influencer

Edit the SimpleXML for the checkbox input and change the delimiter to OR

<fieldset>
  <input type="checkbox" token="yourtoken">
    <choice value="1">One</choice>
    <choice value="2">Two</choice>
    <choice value="3">Three</choice>
    <delimiter> OR </delimiter>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <valuePrefix>index="</valuePrefix>
    <valueSuffix>"</valueSuffix>
  </input>
</fieldset>

Docs: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML

View solution in original post

masonmorales
Influencer

Edit the SimpleXML for the checkbox input and change the delimiter to OR

<fieldset>
  <input type="checkbox" token="yourtoken">
    <choice value="1">One</choice>
    <choice value="2">Two</choice>
    <choice value="3">Three</choice>
    <delimiter> OR </delimiter>
    <prefix>(</prefix>
    <suffix>)</suffix>
    <valuePrefix>index="</valuePrefix>
    <valueSuffix>"</valueSuffix>
  </input>
</fieldset>

Docs: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...