Can I concatenate a complete search query to the already filtered stats results which only executes if an input checkbox is checked

[varun99]

I want to add a checkbox input which just concatenates my search with something like " | search Error" if I check that. Is it possible ?

[micahkemp · Accepted solution]

This is easy with a dropdown, as the below run anywhere dashboard XML illustrates:

<form>
  <label>616525</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="filter_errors" searchWhenChanged="true">
      <label>Filter Errors</label>
      <choice value="| search">No</choice>
      <choice value="| search Error">Yes</choice>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>index=_internal $filter_errors$ | stats count</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
          <sampleRatio>1</sampleRatio>
        </search>
        <option name="count">20</option>
        <option name="dataOverlayMode">none</option>
        <option name="drilldown">none</option>
        <option name="percentagesRow">false</option>
        <option name="rowNumbers">false</option>
        <option name="totalsRow">false</option>
        <option name="wrap">true</option>
      </table>
    </panel>
  </row>
</form>

But, unless I'm missing something, using a checkbox will effectively cause your search not to run (at all) if nothing is checked, as the token would be unset, and hence the search would think it needs to wait for input (until the token is set).

[varun99]

I just tried with the Dropdown and it worked. Thanks a lot.