Hello everybody
I have a dashboard with 4 text inputs (Example: color, shape size, weight)
Splunk takes all these values and performs a search over 9 different indexes.
The problem is that some indexes don't contain all the fields.
for example
Index A has ALL fields
Index B has fields: size, shape and taste
Index C has fields:color, size, sound
that's why when i enter red asterix asterix asterix
i want to have all the events with color=red even if i get something like
red null big 80 indexY
red square small null indexX
by the next search i would define the shape=square as mandatory field
red square small null indexX
null square null null 80 indexZ
Is it somehow possible? maybe with a checkbox?
make field value as null whose value is not present like below-
|eval size=if(isnull(size),"NULL",size), shape=if(isnull(shape),"NULL",shape)
I suppose you got me wrong.
I have 4 inputs
color=/*
size=/*
shape=/*
weight=/*
If user enters
color= red
size=/*
shape=/*
weight=/*
i want to have results like
red smth smth smth
red smth smth smth
red null null smth
But the color column is ALWAYS filled with red
next search
User enters
color= /*
size=Big
shape=/*
weight=/*
I get a table with
smth big smth smth
smth big smth Null
null big smth smth
@alex_kh ,
Suppose when you search with Colour=Red
and other field as *
, then which events you are receiving and what events you are expecting to come as output?
If i run my query with AND
color=$token1$ shape=$token2$ I either get no results or only results from the index which contains all fields
when i do the same stuff with OR
color=$token1$ OR shape=$token2$
I get smth like
red round
red square
yellow round
green triangle
writing AND
makes it compulsory to have both fields in events and making it OR
makes either one of the field is present then also you will get results.
So what is your expected output?