Hi All,
The default behavior when building a dashboard with checkboxes is that the checkboxes equal an AND search. Is there a way to change the behavior to be OR?
For example, I have ten checkboxes index1 index2 index3....... When I do the checkboxes (and choose 2) the search comes out to be "index=1 index=7". I would like it to be "index=1 OR index=7"
thank you,
-Bryan
Edit the SimpleXML for the checkbox input and change the delimiter to OR
<fieldset>
<input type="checkbox" token="yourtoken">
<choice value="1">One</choice>
<choice value="2">Two</choice>
<choice value="3">Three</choice>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>index="</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
Docs: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML
Edit the SimpleXML for the checkbox input and change the delimiter to OR
<fieldset>
<input type="checkbox" token="yourtoken">
<choice value="1">One</choice>
<choice value="2">Two</choice>
<choice value="3">Three</choice>
<delimiter> OR </delimiter>
<prefix>(</prefix>
<suffix>)</suffix>
<valuePrefix>index="</valuePrefix>
<valueSuffix>"</valueSuffix>
</input>
</fieldset>
Docs: http://docs.splunk.com/Documentation/Splunk/6.3.0/Viz/PanelreferenceforSimplifiedXML