How to exclude results from a saved search in a dashboard using a checkbox?

[snix]

I have a saved search that shows IIS logs on a dashboard, it can be a bit verbose depending on the use case. I would like to have an on/off input that would allow the user to filter out some of the non-relevant logs. I figured the checkbox input would make the most sense but I am having issues wrapping my head around how it works and am starting to wander if it is the best option for this solution.

Whatever option I would use would just need to be able to by default filter nothing but if selected add a string into the search for example:

Default off: InputVariable="HTTPStatusCode=*"
Turned on: InputVariable="HTTPStatusCode!=200"
search index=iis $InputVariable$| table field1, field2, field3

[martin_mueller · Accepted solution]

You could use something like this:

<input type="radio" token="field1">
  <choice value="HTTPStatusCode=*">show</choice>
  <choice value="HTTPStatusCode!=200">hide</choice>
</input>

With a one-option checkbox, the unchecked state would leave the token unset - causing the search to wait for input. A radio input is always set, at least when you define an initial/default value.

[martin_mueller]

That radio input is one input with two options 🙂

[snix]

Oh I thought I would need to add a second radio button and tie them together, that makes more sense I will take another look at it then and see what it can do.

Thank You!

[martin_mueller]

You can't uncheck a radio button, but you can select the second option to unselect the first option.

[snix]

I will mark it answered since you did hit on the key issue of the unset token when using the check box make it unusable.

[snix]

I figured as much but for some reason I didn't like the idea of dealing with two inputs when I could set it to deal with only one. So I avoided looking down that path and just trying the dropdown, figured it would then give me room for more filter options in the future if I think of some more.

[snix]

@martin_mueller I tried your suggestion but ran into the issue of unchecking the radio button, it appears to not be an option so I tried the dropdown and got it to work for what I need. Just wish I would have been able to use the checkbox 😞