<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Dropdown to be able to select filter, need all to include null in Dashboards &amp; Visualizations</title>
    <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614164#M50365</link>
    <description>&lt;P&gt;Oh, sorry, I missed that part.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;You can check if the length of the value is over a certain length and if it isn't, set it to null. Then fillnull :&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;| eval&amp;nbsp;&lt;SPAN&gt;hw_stat_column=if(len(hw_stat_column) &amp;gt; 2,&amp;nbsp;hw_stat_column, null())&lt;BR /&gt;| fillnull value="N/A"&amp;nbsp;hw_stat_column&lt;/SPAN&gt;&lt;/P&gt;</description>
    <pubDate>Thu, 22 Sep 2022 16:14:17 GMT</pubDate>
    <dc:creator>andrew_nelson</dc:creator>
    <dc:date>2022-09-22T16:14:17Z</dc:date>
    <item>
      <title>How to make dropdown select filter "need all to include null"?</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614130#M50362</link>
      <description>&lt;P&gt;I am trying to create a dashboard that has a dropdown input eg:&lt;/P&gt;
&lt;DIV&gt;
&lt;DIV&gt;&lt;LI-CODE lang="markup"&gt;    &amp;lt;input type="dropdown" token="HWStat" searchWhenChanged="true"&amp;gt;
        &amp;lt;label&amp;gt;HW Status&amp;lt;/label&amp;gt;
        &amp;lt;choice value="*"&amp;gt;All&amp;lt;/choice&amp;gt;
        &amp;lt;choice value="Installed"&amp;gt;Installed&amp;lt;/choice&amp;gt;
        &amp;lt;default&amp;gt;*&amp;lt;/default&amp;gt;
        &amp;lt;initialValue&amp;gt;*&amp;lt;/initialValue&amp;gt;
    &amp;lt;/input&amp;gt;&lt;/LI-CODE&gt;&lt;/DIV&gt;
&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV&gt;&lt;SPAN&gt;This was the easier part.&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV&gt;&lt;SPAN&gt;Now when I go to use the token $HWStat$ it's just fine for passing the "Installed" option to the search.&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV&gt;&lt;SPAN&gt;However, the asterisk "*" option for all when passed only displays results with values.&amp;nbsp; I know there are a lot of "null" values in there as well that I would like the output to display.&amp;nbsp; Also there appears to be some with "blanks" as well. &lt;/SPAN&gt;&lt;/DIV&gt;
&lt;DIV&gt;&lt;SPAN&gt;(I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank).&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV&gt;basic search I was testing:&lt;/DIV&gt;
&lt;DIV&gt;ending with:&lt;/DIV&gt;
&lt;DIV&gt;| stats ...&lt;/DIV&gt;
&lt;DIV&gt;
&lt;DIV&gt;
&lt;DIV&gt;&lt;SPAN&gt;|&lt;/SPAN&gt;&lt;SPAN&gt; search&lt;/SPAN&gt;&amp;nbsp;hw_stat_column&lt;SPAN&gt;=$HWStat$&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;
&lt;DIV&gt;&lt;SPAN&gt;What is the better option to pass other than "*" to capture everything?&amp;nbsp; I've scoured the internet, and this is not an easy thing to search for.&amp;nbsp; Thanks in advance!&lt;/SPAN&gt;&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;
&lt;/DIV&gt;</description>
      <pubDate>Thu, 22 Sep 2022 16:00:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614130#M50362</guid>
      <dc:creator>maxsteel</dc:creator>
      <dc:date>2022-09-22T16:00:53Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown to be able to select filter, need all to include null</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614136#M50363</link>
      <description>&lt;P&gt;Easiest way to get around it is using fillnull in your search after your stats.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;| fillnull value="N/A"&amp;nbsp;&lt;SPAN&gt;hw_stat_column&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 22 Sep 2022 14:11:24 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614136#M50363</guid>
      <dc:creator>andrew_nelson</dc:creator>
      <dc:date>2022-09-22T14:11:24Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown to be able to select filter, need all to include null</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614163#M50364</link>
      <description>&lt;P&gt;in my OP I mentioned:&lt;BR /&gt;&lt;SPAN&gt;(I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank).&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;and wasn't displaying those..&lt;/P&gt;</description>
      <pubDate>Thu, 22 Sep 2022 15:36:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614163#M50364</guid>
      <dc:creator>maxsteel</dc:creator>
      <dc:date>2022-09-22T15:36:48Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown to be able to select filter, need all to include null</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614164#M50365</link>
      <description>&lt;P&gt;Oh, sorry, I missed that part.&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;You can check if the length of the value is over a certain length and if it isn't, set it to null. Then fillnull :&amp;nbsp;&lt;BR /&gt;&lt;BR /&gt;| eval&amp;nbsp;&lt;SPAN&gt;hw_stat_column=if(len(hw_stat_column) &amp;gt; 2,&amp;nbsp;hw_stat_column, null())&lt;BR /&gt;| fillnull value="N/A"&amp;nbsp;hw_stat_column&lt;/SPAN&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 22 Sep 2022 16:14:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614164#M50365</guid>
      <dc:creator>andrew_nelson</dc:creator>
      <dc:date>2022-09-22T16:14:17Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown to be able to select filter, need all to include null</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614168#M50366</link>
      <description>&lt;P&gt;(no worries, I appreciate the help)&lt;BR /&gt;I tried this but didn't really like it:&lt;/P&gt;&lt;P&gt;Here's the high level of what I tried:&lt;/P&gt;&lt;DIV&gt;| stats ...&lt;/DIV&gt;&lt;DIV&gt;&lt;DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&lt;/SPAN&gt;&lt;SPAN&gt; eval&lt;/SPAN&gt; hw_stat_column&lt;SPAN&gt;=&lt;/SPAN&gt;&lt;SPAN&gt;if&lt;/SPAN&gt;&lt;SPAN&gt;(&lt;/SPAN&gt;&lt;SPAN&gt;len&lt;/SPAN&gt;&lt;SPAN&gt;(hw_stat_column&lt;/SPAN&gt;&lt;SPAN&gt;&amp;gt; 2&lt;/SPAN&gt;&lt;SPAN&gt;),&lt;/SPAN&gt;&lt;SPAN&gt; hw_stat_column&lt;/SPAN&gt;&lt;SPAN&gt;, &lt;/SPAN&gt;&lt;SPAN&gt;null&lt;/SPAN&gt;&lt;SPAN&gt;())&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&lt;/SPAN&gt;&lt;SPAN&gt; fillnull&lt;/SPAN&gt; &lt;SPAN&gt;value&lt;/SPAN&gt;&lt;SPAN&gt;=&lt;/SPAN&gt;&lt;SPAN&gt;"N/A"&lt;/SPAN&gt;&lt;SPAN&gt; hw_stat_column&lt;/SPAN&gt;&lt;/DIV&gt;&lt;/DIV&gt;&lt;/DIV&gt;&lt;DIV&gt;&lt;DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;|&lt;/SPAN&gt;&lt;SPAN&gt;&amp;nbsp;search&lt;/SPAN&gt;&amp;nbsp;hw_stat_column&lt;SPAN&gt;=$HWStat$&lt;/SPAN&gt;&lt;/DIV&gt;&lt;DIV&gt;&amp;nbsp;&lt;/DIV&gt;&lt;DIV&gt;&lt;SPAN&gt;got this:&lt;BR /&gt;&amp;nbsp;Error in 'EvalCommand': The arguments to the 'len' function are invalid.&lt;BR /&gt;&lt;/SPAN&gt;&lt;/DIV&gt;&lt;/DIV&gt;&lt;/DIV&gt;</description>
      <pubDate>Thu, 22 Sep 2022 15:57:34 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614168#M50366</guid>
      <dc:creator>maxsteel</dc:creator>
      <dc:date>2022-09-22T15:57:34Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown to be able to select filter, need all to include null</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614170#M50367</link>
      <description>&lt;P&gt;I had the closing parenthesis for len() in the wrong place. My bad. I've updated it above.&lt;/P&gt;</description>
      <pubDate>Thu, 22 Sep 2022 16:14:45 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614170#M50367</guid>
      <dc:creator>andrew_nelson</dc:creator>
      <dc:date>2022-09-22T16:14:45Z</dc:date>
    </item>
    <item>
      <title>Re: Dropdown to be able to select filter, need all to include null</title>
      <link>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614193#M50369</link>
      <description>&lt;P&gt;oh boy, I should have caught that too.. d'oh!&amp;nbsp; Thanks for your help, this now appears to work as expected.&lt;/P&gt;&lt;P&gt;I would have preferred to have been able to keep the blanks in the table I created as it was sourced from 4 different datasources, and the blanks were much easier to see when there were issues to be 'spotted'.&amp;nbsp; But alas, like all data, nulls and spaces are our worst enemies, so massaging to things like N/A are needed....&lt;/P&gt;&lt;P&gt;too bad "*" didn't just work for ALL and ANYTHING &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Thu, 22 Sep 2022 18:07:52 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Dashboards-Visualizations/How-to-make-dropdown-select-filter-quot-need-all-to-include-null/m-p/614193#M50369</guid>
      <dc:creator>maxsteel</dc:creator>
      <dc:date>2022-09-22T18:07:52Z</dc:date>
    </item>
  </channel>
</rss>

