topic Re: Exclulsion of values in Splunk Search

Exclusion of values on dashboard- How to fix this?

sahana — Fri, 27 May 2022 15:08:17 GMT

Hi,

I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL.

Based on the above selection I have an panel that shows the success / failure counts graphs will appear.

The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values.

So, can you help on fixing this issue??

Thanks,

Sahana

Re: Exclulsion of values

ITWhisperer — Fri, 27 May 2022 02:03:15 GMT

Can you share the search that is giving you this issue?

Re: Exclulsion of values

sahana — Fri, 27 May 2022 02:59:52 GMT

@ITWhisperer

The search is

index=123245 envId=* countryCode=$selected_Country$ httpserviceStatus=500 OR message.status=* Or message.abpsStatus =* appName!=Null | dedup requestId| eval status= case(like('httpServiceStatus'."%50%") OR like('message.status',"Failure")OR like('message.abpsStatus',"Failure") | eval Failures=if(status="Failure",1,0)|timeChart span=1h count(Failures) as Fail by countryCode

The selected_Country will pass values like(SG,Hk,MY,ID) but somehow we are getting graphs for (null, Value,Other) values also

So I am in need that the query should show the graphs for these countries alone based on selection SG,Hk,MY,ID and should ignore other values if I selected *(ALL) in the selected_Country token

Re: Exclulsion of values

ITWhisperer — Fri, 27 May 2022 03:30:55 GMT

Are you getting the issue when you select a single country e.g. "SG" or only when you select all countries "*"?

Re: Exclulsion of values

sahana — Fri, 27 May 2022 04:12:24 GMT

@ITWhisperer

In both the cases we are getting the "null"

but when I select All i am getting all the un wanted values

Re: Exclulsion of values

ITWhisperer — Fri, 27 May 2022 07:38:09 GMT

limit=0 should get rid of OTHER and usenull=f should get rid of NULL

|timeChart limit=0 span=1h count(Failures) as Fail by countryCode usenull=f

Re: Exclulsion of values

sahana — Fri, 27 May 2022 09:50:34 GMT

@ITWhisperer

But I am getting values like ('VALUE',38,18 ) also in the same graphs

Re: Exclulsion of values

ITWhisperer — Fri, 27 May 2022 09:57:15 GMT

Is countryCode a multi-value field?