space in values does not filter data

koreamit3483 — Wed, 01 Dec 2021 10:50:46 GMT

I have data coming in where I have a field called Result which holds data as below

1) "FAIL"

2) " FAIL "

3) "PASS"

4) " PASS "

now i have created a dashboard where the Result field is used in Drop down box. I have cleared the extra space from the field using

| rex mode = sed field=Result "s/ //g"|

in dropdown values.

I have a data also showing on dashboard using the count as

stats count(eval(searchmatch("PASS"))) AS PASS count(eval(searchmatch("FAIL"))) AS FAIL

which also have cleared the space using

| rex mode = sed field=Result "s/ //g"|

but when I select "PASS" or "FAIL" in drop down and submit the data on dashboard, it excludes the data which has values with space in it (i.e. " FAIL " and " PASS ") and shows only the values without space.

How can I solve this.

Re: space in values does not filter data

Gr0und_Z3r0 — Wed, 01 Dec 2021 11:19:46 GMT

Use |search result=*PASS* OR result=*FAIL* accordingly

Re: space in values does not filter data

koreamit3483 — Wed, 01 Dec 2021 11:30:48 GMT

Tried this doing but still not filtering data over dashboard.

Re: space in values does not filter data

yuanliu — Thu, 02 Dec 2021 08:57:36 GMT

@koreamit3483 wrote:
I have data coming in where I have a field called Result which holds data as below
1) "FAIL"
2) " FAIL "
3) "PASS"
4) " PASS "
now i have created a dashboard where the Result field is used in Drop down box. I have cleared the extra space from the field using
| rex mode = sed field=Result "s/ //g"|
in dropdown values.
I have a data also showing on dashboard using the count as
stats count(eval(searchmatch("PASS"))) AS PASS count(eval(searchmatch("FAIL"))) AS FAIL
which also have cleared the space using
| rex mode = sed field=Result "s/ //g"|
but when I select "PASS" or "FAIL" in drop down and submit the data on dashboard, it excludes the data which has values with space in it (i.e. " FAIL " and " PASS ") and shows only the values without space.
How can I solve this.

(Nested Spoiler tags make the question very difficult to read. Additionally, if you illustrate actual search terms in your dashboard search, the question will be much clearer; specifically, illustrate how the dropdown token is being used in the search.)

Suppose your dropdown token is $results_tok$ and your dashboard search is something like

Results = $results_tok$ blah ``` token used in base search without modification will fail to capture events with space in Results ``` | stats blah

it will only get events without space. This is expected.

@Gr0und_Z3r0 suggests using "*" wildcard. It should work in base search, e.g.,

Results = $results_tok$* blah | stats blah

In short, you need to illustrate sanitized search code for others to diagnose a problem.

Here is an emulation of the solution suggested by Gr0und_Z3r0.

| makeresults count=16 ``` emulating raw events ``` | streamstats count | eval Result = if(count % 2 == 0, "PASS", "FAIL") | eval Result = if(count % 4 == 0, Result . " ", Result) | eval result = ">" . Result . "<" ``` the following emulates base search where dropdown token value is "PASS" ``` | search Result = PASS*

The result includes both "PASS" and "PASS "

Result	_time	count	result
PASS	2021-12-02 00:54:03	2	>PASS<
PASS	2021-12-02 00:54:03	4	>PASS <
PASS	2021-12-02 00:54:03	6	>PASS<
PASS	2021-12-02 00:54:03	8	>PASS <
PASS	2021-12-02 00:54:03	10	>PASS<
PASS	2021-12-02 00:54:03	12	>PASS <
PASS	2021-12-02 00:54:03	14	>PASS<
PASS	2021-12-02 00:54:03	16	>PASS <

topic Re: space in values does not filter data in Splunk Search

space in values does not filter data

Re: space in values does not filter data

Re: space in values does not filter data

Re: space in values does not filter data