Archive

help on a dropdown list static option for empty field

jip31
Builder

Hi
In a dashboard I use a doropdown list
the dropdown list is updated like this :
| inputlookup toto.csv
| fields SITE
| dedup SITE
| table SITE
| sort +SITE

Then, I use the search below in order to be able to filter the search results by SITE
it works, but I also want to be able to display the hosts from host.csv which have no SITE in toto.csv because sometimes this field is empty
what I have to add in the static option to do this please?

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

thanks

Tags (1)
0 Karma
1 Solution

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

View solution in original post

0 Karma

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

View solution in original post

0 Karma

jip31
Builder

thanks for your answer

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!