https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115592#M30641 <P>The default value you set as "<EM>" is correct, but the term * will not match any NULL values. You would have to build appropriate filters within your search to ensure that if "</EM>" is selected in form input (or no selection of input value with default as "*"), it matches NULL/Empty field values as well.</P> <P>Something like this</P> <PRE><CODE>Your base search ... | eval field1=coalesce(field1,"NA") | search field1=$inputForField1$ </CODE></PRE> Tue, 24 Jun 2014 14:59:24 GMT somesoni2 2014-06-24T14:59:24Z https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115589#M30638 <P>Hi<BR /> I have an interactive dashboard with form inputs, i have set default value as * for all the form inputs, depends on the input value/values my search has to execute and matched records of the Table has to display in my panel.If any form input is not given,it can take any value including null/empty. If a particular Field of the table is completely empty, search displays "no record found". what is the default value i have to set so that i can get the records of the table eventhough a particular field is empty.</P> Mon, 23 Jun 2014 15:43:25 GMT https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115589#M30638 Mubarish 2014-06-23T15:43:25Z https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115590#M30639 <P>There is no default value that you can set - you will have to take this into account in the search string itself.</P> Mon, 23 Jun 2014 22:11:03 GMT https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115590#M30639 lguinn2 2014-06-23T22:11:03Z https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115591#M30640 <P>I referred the below link for assigning default value as "<EM>" for my form inputs.<A href="http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/Buildandeditforms">http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/Buildandeditforms</A><BR /> We assumed that "</EM>" takes any non-zero value and execute the search wheras we get "No results found" if any of the field in the log has empty value.Can you please clarify what does "*" means here</P> Tue, 24 Jun 2014 14:08:43 GMT https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115591#M30640 Mubarish 2014-06-24T14:08:43Z https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115592#M30641 <P>The default value you set as "<EM>" is correct, but the term * will not match any NULL values. You would have to build appropriate filters within your search to ensure that if "</EM>" is selected in form input (or no selection of input value with default as "*"), it matches NULL/Empty field values as well.</P> <P>Something like this</P> <PRE><CODE>Your base search ... | eval field1=coalesce(field1,"NA") | search field1=$inputForField1$ </CODE></PRE> Tue, 24 Jun 2014 14:59:24 GMT https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/115592#M30641 somesoni2 2014-06-24T14:59:24Z https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/506578#M141720 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/15147">@somesoni2</a>&nbsp;how do we do this, if we have like multiple inputs which are likely to have NULL values. I tried my hand with fillnull, it works but the search results come back too slow and delayed.&nbsp;</P> Mon, 29 Jun 2020 18:56:59 GMT https://community.splunk.com/t5/Splunk-Search/searching-the-records-of-the-table-with-empty-field/m-p/506578#M141720 cbirajdar 2020-06-29T18:56:59Z