I am using the following Simple XML for a check box in a dashboard (Splunk Enterprise 6.4):Exclude blacklisted transaction codes NOT [|inputlookup tran_blacklist.csv]
That is, I have a single check box that appears on the dashboard like this:
[x] Exclude blacklisted transaction codes
The corresponding blacklist token is used in panel search strings like this (simplified example for the sake of clarity):
sourcetype=my_log_type $blacklist$ | timechart count by tran
When the check box is selected, this works as intended: it excludes certain transaction codes from the chart.
However, if the check box is not selected, the chart displays "Search is waiting for input..." due to the blacklist token not being set.
How do I avoid this problem?
My first thought was to investigate how, within the `` element, to specify a value for the blacklist token if that single "Exclude..." `` is not selected, but I couldn't see how to do that.
My next thought was to investigate how to use `
↧