How to run a search with undefined token

[ktn01]

Hello,
I have a panel on a dashboard with a search using a token to exclude events with some field values.

Search is something like index=myindex sourcetype=mysourcetype $exclude$

The "exclude" token is generated from a checkbox input which generate a string like "myfield!=value1 myfield!=value2 ..."

This is working fine if at less one entry on checkbox is selected but a have the message Search is waiting for input...if no entries are selected.

I open the panel in search and see undefined on search bar.

Is it possible to run the search even if the token is not defined or to have an empty defined token if all entries on checkbox are unchecked?

Thanks

[amar2212]

Hi,
i have the same issue mention above but in my dashboard i have two dropdowns with Apps and Indexes , i have passed a token of App dropdown to index. Here when i select the Particular App Dropdown it will show the index which it has, for Some apps there is no index then the the panels are show that search is waiting for input but my question is that i have to show in the panels 0 Value instead of search is waiting for the input, Help me with this.

[niketn]

@ktn01, while you have not shared SimpleXML code for your checkbox, following is an example based on Splunk's _internal index.
I have defined introduced an empty checkbox choice None for Exclusion <choice value="">None</choice>, which is the default selection <default></default>

<input type="checkbox" token="tokExclude">
  <label>Exclude</label>
  <choice value="">None</choice>
  <choice value="log_level!=&quot;INFO&quot;">INFO</choice>
  <choice value="log_level!=&quot;ERROR&quot;">ERROR</choice>
  <choice value="log_level!=&quot;WARN&quot;">WARN</choice>
  <choice value="log_level!=&quot;FATAL&quot;">FATAL</choice>
  <default></default>
</input>

Following is the query which runs on Splunk's _internal index:

      <query>index=_internal sourcetype=splunkd $tokExclude$
     | stats count</query>

[cmerriman]

if you set the token to nothing, it should work:

 <init>
     <set token="exclude">&#32;</set>
</init>

and then did a

<change>
    <condition value="true">
       <set token="exclude">true</set>
    </condition>
</change>

however, this will always make exclude equal to something, so if you're using it in a depends statement, it won't work anymore. you'd need possibly eval a new token with condition match to make the depends work.