https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393500#M172887 <P>in that case, it might not be null() but just an empty space , try adding this </P> <P><CODE>if(isnull(param) OR param=="", 50, param)</CODE></P> Thu, 21 Feb 2019 15:03:32 GMT renjith_nair 2019-02-21T15:03:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393497#M172884 <P>Hi splunk comunity!</P> <P>I have dashboard with text input, which starts to execute when i change my parameter in text box, in query i write this parameter to my csv file.<BR /> In another dashboard i'm trying to read latest value of this parameter, but if i post an empty field in my first dashboard i get an empty result in my second.<BR /> So the question is how to check an empty value like method isEmpty() in java or how to ban empty fields passing to csv file in first dashboard?<BR /> Or how can i display last not empty value?</P> Thu, 21 Feb 2019 14:00:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393497#M172884 mishaaaaaaaaaa 2019-02-21T14:00:19Z https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393498#M172885 <P>@mishaaaaaaaaaa ,</P> <P>Either use <CODE>| where isnotnull(field)</CODE> while reading or check with <CODE>isnotnull(field)</CODE> or <CODE>isnull(field)</CODE> before writing,</P> <P>Reference : <A href="https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/InformationalFunctions">https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/InformationalFunctions</A></P> Thu, 21 Feb 2019 14:09:12 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393498#M172885 renjith_nair 2019-02-21T14:09:12Z https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393499#M172886 <P>@renjith.nair This doesn't work, i've already tryed something like this, but i still get an emty field in my second dushboard</P> <P>| makeresults<BR /> | eval param="$firstParam$"<BR /> | eval parameter=if(isnull(param), 50, param)<BR /> | outputcsv append=true mishasTestParametrization.csv<BR /> | table parameter</P> <P>| inputcsv mishasTestParametrization.csv<BR /> | stats latest(parameter) as latestParam</P> Thu, 21 Feb 2019 14:22:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393499#M172886 mishaaaaaaaaaa 2019-02-21T14:22:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393500#M172887 <P>in that case, it might not be null() but just an empty space , try adding this </P> <P><CODE>if(isnull(param) OR param=="", 50, param)</CODE></P> Thu, 21 Feb 2019 15:03:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393500#M172887 renjith_nair 2019-02-21T15:03:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393501#M172888 <P>@renjith.nair yes this works, but i understud that this is not what i want. I need to write to csv if my param is not empty and don't write if it's empty</P> Fri, 22 Feb 2019 06:27:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393501#M172888 mishaaaaaaaaaa 2019-02-22T06:27:33Z https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393502#M172889 <P>@mishaaaaaaaaaa ,<BR /> Same can be used in the outputlookup as well. Taking your example</P> <PRE><CODE>| makeresults | eval param="$firstParam$" | where param!="" AND isnotnull(param) | outputcsv append=true mishasTestParametrization.csv </CODE></PRE> Fri, 22 Feb 2019 14:10:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393502#M172889 renjith_nair 2019-02-22T14:10:38Z https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393503#M172890 <P>thanks a lot, that works perfect!</P> Mon, 25 Feb 2019 06:19:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-latest-parameter-from-csv-disregarding-empty-values/m-p/393503#M172890 mishaaaaaaaaaa 2019-02-25T06:19:01Z