Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I use a token in a dashboard panel chart search query that is currently only set when a check box is selected?

$
0
0
I am using the following Simple XML for a check box in a dashboard (Splunk Enterprise 6.4):Exclude blacklisted transaction codesNOT [|inputlookup tran_blacklist.csv] That is, I have a single check box that appears on the dashboard like this: [x] Exclude blacklisted transaction codes The corresponding blacklist token is used in panel search strings like this (simplified example for the sake of clarity): sourcetype=my_log_type $blacklist$ | timechart count by tran When the check box is selected, this works as intended: it excludes certain transaction codes from the chart. However, if the check box is not selected, the chart displays "Search is waiting for input..." due to the blacklist token not being set. How do I avoid this problem? My first thought was to investigate how, within the `` element, to specify a value for the blacklist token if that single "Exclude..." `` is not selected, but I couldn't see how to do that. My next thought was to investigate how to use `

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>