Dashboards & Visualizations

How to run a search with undefined token

ktn01
Path Finder

Hello,
I have a panel on a dashboard with a search using a token to exclude events with some field values.

Search is something like index=myindex sourcetype=mysourcetype $exclude$

The "exclude" token is generated from a checkbox input which generate a string like "myfield!=value1 myfield!=value2 ..."

This is working fine if at less one entry on checkbox is selected but a have the message Search is waiting for input...if no entries are selected.

I open the panel in search and see undefined on search bar.

Is it possible to run the search even if the token is not defined or to have an empty defined token if all entries on checkbox are unchecked?

Thanks

0 Karma

amar2212
New Member

Hi,
i have the same issue mention above but in my dashboard i have two dropdowns with Apps and Indexes , i have passed a token of App dropdown to index. Here when i select the Particular App Dropdown it will show the index which it has, for Some apps there is no index then the the panels are show that search is waiting for input but my question is that i have to show in the panels 0 Value instead of search is waiting for the input, Help me with this.

0 Karma

niketn
Legend

@ktn01, while you have not shared SimpleXML code for your checkbox, following is an example based on Splunk's _internal index.
I have defined introduced an empty checkbox choice None for Exclusion <choice value="">None</choice>, which is the default selection <default></default>

<input type="checkbox" token="tokExclude">
  <label>Exclude</label>
  <choice value="">None</choice>
  <choice value="log_level!=&quot;INFO&quot;">INFO</choice>
  <choice value="log_level!=&quot;ERROR&quot;">ERROR</choice>
  <choice value="log_level!=&quot;WARN&quot;">WARN</choice>
  <choice value="log_level!=&quot;FATAL&quot;">FATAL</choice>
  <default></default>
</input>

Following is the query which runs on Splunk's _internal index:

      <query>index=_internal sourcetype=splunkd $tokExclude$
     | stats count</query>
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

cmerriman
Super Champion

if you set the token to nothing, it should work:

 <init>
     <set token="exclude">&#32;</set>
</init>

and then did a

<change>
    <condition value="true">
       <set token="exclude">true</set>
    </condition>
</change>

however, this will always make exclude equal to something, so if you're using it in a depends statement, it won't work anymore. you'd need possibly eval a new token with condition match to make the depends work.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...