Dashboards & Visualizations

Dashboard studio: How to create search for value that may be null - efficiently?

Andy-AVA
Engager

Hello!

I'm using a text input box to input a username. If I were to simply put that username into my base search, it works great and is very quick. I have other search input parameters, so my problem is that if I DON'T specify a username, I want it to include all values. This includes null values. I started by using an asterisk as the default input value, but that doesn't include null values. The only way I've been able to make this partially work is by removing the username from the base search, then using an eval command to give the null entries a value, and then search the base results for either "*" to include everything, or the username I typed in. This is horribly inefficient because I have to search my entire database for every entry before I can filter it. I also think this doesn't work properly because it has a limit on the number of results in the base search. 

I've done a lot of searching for doing an eval command BEFORE the base search, but that doesn't seem to be possible. This can't be a unique scenario. How do I search for both "null" and "NOT null" values in the base search without removing my username input box?

Labels (2)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Set the default of your text input to "*" and extend your initial search like this

index=<your index and other filters> 
    [| makeresults
    | fields - _time
    | eval username="$your_text_search$"
    | where username!="*"
    | return username]

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Set the default of your text input to "*" and extend your initial search like this

index=<your index and other filters> 
    [| makeresults
    | fields - _time
    | eval username="$your_text_search$"
    | where username!="*"
    | return username]

Andy-AVA
Engager

Genius! Thank you! I spent WAY too much time trying to find out how to do that. I skipped the "fields - _time" section. I'm not sure what that's for? It seems to work well without it.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Yes, you don't need that - it is just a habit I have when using makeresults as it is the only field that is automatically added by makeresults.

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...