Checkbox and dropdown

[sreelesh_n]

below is my dashboard code, when checkbox is selected i want splunkd* only to be shown in the dropdown else all.
below code seems like is finding checkbox is selected and going to if section , but,sourcetype like "splunkd*" is always evaluating to true/false and also like doesnt seems to work ? any updates?

    <query>index=_internal | eval field1=    if(replace("$applyFilter$",".*(\d)","\1")="1",sourcetype like  "splunkd*", ,sourcetype)</query>

--Sree

<form>
  <label>ConditionalFilter1</label>
  <fieldset submitButton="false">
    <input type="checkbox" token="applyFilter" searchWhenChanged="true">
      <label></label>
      <choice value="1">Apply Filter</choice>
      <default>0</default>
    </input>
    <inpu't type="dropdown" token="field1" searchWhenChanged="true">'
      <search>
        <query>index=_internal | eval field1=    if(replace("$applyFilter$",".*(\d)","\1")="1",sourcetype,sourcetype)</query>
      </search>
      <fieldForLabel>field1</fieldForLabel>
      <fieldForValue>field1</fieldForValue>
    </input>
  </fieldset>
</form>

[sundareshr · Accepted solution]

Give this a shot. Set the default and initial values to "" for "un-selected" state & to "splunk" for selected state. In your search query for the dropdown, set sourcetype=$field1*

ConditionalFilter1

<input type="checkbox" token="field1" searchWhenChanged="true">
  <choice value="splunkd">splunkd</choice>
  <default></default>
  <initialValue></initialValue>
</input>
<input type="dropdown" token="field2" searchWhenChanged="true">
  <search>
    <query>index=_internal sourcetype=$field1$*  | dedup sourcetype</query>
    <earliest>@d</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
</input>


<panel>
  <event>
    <title>User selections - radio: $field1$; dropdown: $field2$</title>
    <search>
      <query>index=_internal sourcetype=$field2$</query>
      <earliest>-15m</earliest>
      <latest>now</latest>
    </search>
  </event>
</panel>

[sreelesh_n]

this is working fine , but with search options seems like it's not . I need to do on a particular field , but it gives an error Error msg is != have an invalid symbol at the left side

    <query>index=u2 sourcetype=jms_body_header_txt | fields ProcessContext_ProjectName 
      | search  ProcessContext_ProjectName =  $field1$*   | dedup ProcessContext_ProjectName           
     | table ProcessContext_ProjectName</query>
  </search>

[sreelesh_n]

thanks,it what I needed.

but i also need to do for not equals, any advise? i tried below but it's not working
index=_internal | search NOT sourcetype = $field1$* | dedup sourcetype

if field = splunkd (ie selected) , then excluding splunkd* should be shown
else all should be shown

[sundareshr]

Here's one way. Set the "value" for selected checkbox to !=splunkd and add a prefix of "sourcetype" and default value of ""

<form>
  <label>ConditionalFilter1</label>
  <fieldset submitButton="false" autoRun="true">
    <input type="checkbox" token="field1" searchWhenChanged="true">
      <choice value="!=splunkd">splunkd</choice>
      <prefix>sourcetype</prefix>
      <default></default>
    </input>
    <input type="dropdown" token="field2" searchWhenChanged="true">
      <search>
        <query>index=_internal $field1$*  | dedup sourcetype</query>
        <earliest>@d</earliest>
        <latest>now</latest>
      </search>
      <fieldForLabel>sourcetype</fieldForLabel>
      <fieldForValue>sourcetype</fieldForValue>
    </input>
  </fieldset>
  <row>
    <panel>
      <event>
        <title>User selections - radio: $field1$; dropdown: $field2$</title>
        <search>
          <query>index=_internal sourcetype=$field2$</query>
          <earliest>-15m</earliest>
          <latest>now</latest>
        </search>
      </event>
    </panel>
  </row>
</form>

[sundareshr]

I am not sure I understand your question or what it is that you are trying to do. You dashboard has no controls, not sure it will render anything. Can you explain what is the dashboard supposed to do?

Does this give you what you are looking for?

ConditionalFilter1

<input type="radio" token="field1" searchWhenChanged="true">
  <choice value="splunkd">splunkd</choice>
  <choice value="*">all</choice>
  <default>*</default>
  <initialValue>*</initialValue>
</input>
<input type="dropdown" token="field2" searchWhenChanged="true">
  <search>
    <query>index=_internal sourcetype=$field1$  | dedup sourcetype</query>
    <earliest>@d</earliest>
    <latest>now</latest>
  </search>
  <fieldForLabel>sourcetype</fieldForLabel>
  <fieldForValue>sourcetype</fieldForValue>
</input>

[sreelesh_n]

thank you , this is what i was looking for ,btw i have added this to my actual code and there it 's not working
i am applying this for my interested field ProcessContext_ProjectName
but it gives an error " it could not create a search -syntax error as left hand of != doesnt have invalid term on left side "
pls note that i have used a search query to filter out field
Thanks,

TSNew

<input type="dropdown" token="ProcessContext_ProjectName" searchWhenChanged="true">
  <search>
    <query>index=u2 sourcetype=jms_body_header_txt | fields ProcessContext_ProjectName 
      | search  ProcessContext_ProjectName =  $field1$*   | dedup ProcessContext_ProjectName           
     | table ProcessContext_ProjectName</query>
  </search>
  <fieldForLabel>ProcessContext_ProjectName</fieldForLabel>
  <fieldForValue>ProcessContext_ProjectName</fieldForValue>
</input>
 <input type="checkbox" token="field1" searchWhenChanged="true">
   <choice value="!=JMSAdapter">JMSAdapter</choice>
   <prefix>ProcessContext_ProjectName</prefix>
   <default></default>
 </input>

[sreelesh_n]

hi,

sourcetype has dynamic list of values ("splunkd1" , "splunkd2", "appd" , "splunktest") . if checkfox is selected i need only splunkd1 ,splunkd2 ones to be shown in drop down , else all the 4 .

fyi - drop down is a search criteria for me -i have a chart to show based on what i select from above dropdown.