Dashboards & Visualizations

help on a dropdown list static option for empty field

jip31
Motivator

Hi
In a dashboard I use a doropdown list
the dropdown list is updated like this :
| inputlookup toto.csv
| fields SITE
| dedup SITE
| table SITE
| sort +SITE

Then, I use the search below in order to be able to filter the search results by SITE
it works, but I also want to be able to display the hosts from host.csv which have no SITE in toto.csv because sometimes this field is empty
what I have to add in the static option to do this please?

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

thanks

Tags (1)
0 Karma
1 Solution

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

View solution in original post

0 Karma

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

0 Karma

jip31
Motivator

thanks for your answer

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...