Splunk Search

Checkbox usage in splunk dashboard

bharathkumarnec
Contributor

Hi All,

I am using 5 checkboxes and when i select any of the checkbox then only corresponding chart will be visible, challenge here is even though i select the checkbox or not, query for all the 5 checkboxes are running backend.

So checkbox is only giving me the option of hide & visibility.

Kindly help me out if this is the purpose of the checkbox and also is there anyway that only when selected a chart query has to run.

Regards,
BK

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi @bharathkumarnec,

Can you please try this dashboard XML?

<form>
  <label>Search on click of Check Box </label>
  <fieldset submitButton="false">
    <input type="checkbox" token="tkn_chk1">
      <label>Check box 1</label>
      <choice value="true">Chk1</choice>
      <change>
        <condition value="true">
          <set token="chkA"></set>
        </condition>
        <condition value="*">
          <unset token="chkA"></unset>
        </condition>
      </change>
    </input>
    <input type="checkbox" token="tkn_chk2">
      <label>Check box 2</label>
      <choice value="true">Chk2</choice>
      <change>
        <condition value="true">
          <set token="chkB"></set>
        </condition>
        <condition value="*">
          <unset token="chkB"></unset>
        </condition>
      </change>
    </input>
  </fieldset>
  <row>
    <panel depends="$chkA$">
      <table>
        <title>Panel 1</title>
        <search>
          <query>index=_internal  $chkA$ | stats count by sourcetype</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
  <row>
    <panel depends="$chkB$">
      <table>
        <title>Panel 2</title>
        <search>
          <query>index=_internal  $chkB$ | stats count by source</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">100</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

Thanks

0 Karma

bharathkumarnec
Contributor

So how will be the token $chkA$ & $chkB$ will take affect to my queries??

0 Karma

micahkemp
Champion

You can use some trickery to accomplish what you're looking for.

Try having your checkbox set a value that is essentially a "no-op" in your search. For example, if your panel runs a typical indexed search like index=main sourcetype=firewall src=$src$ dest=$dest$, you could have your checkbox set its value to the implied search command. The search would then look like this: $checkbox$ index=main sourcetype=firewall src=$src$ dest=$dest$. When your checkbox is selected the $checkbox$ token will get replaced with the search command and the search will kick off.

The key to having the search not running in the background is to make sure that the query contains a token that isn't defined until your checkbox is selected.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...