Dashboards & Visualizations

How do I make one field mandatory?

alex_kh
Explorer

Hello everybody

I have a dashboard with 4 text inputs (Example: color, shape size, weight)

Splunk takes all these values and performs a search over 9 different indexes.

The problem is that some indexes don't contain all the fields.
for example

Index A has ALL fields
Index B has fields: size, shape and taste
Index C has fields:color, size, sound

that's why when i enter red asterix asterix asterix

i want to have all the events with color=red even if i get something like
red null big 80 indexY
red square small null indexX

by the next search i would define the shape=square as mandatory field
red square small null indexX
null square null null 80 indexZ

Is it somehow possible? maybe with a checkbox?

Tags (1)
0 Karma

493669
Super Champion

make field value as null whose value is not present like below-

|eval size=if(isnull(size),"NULL",size), shape=if(isnull(shape),"NULL",shape)
0 Karma

alex_kh
Explorer

I suppose you got me wrong.

I have 4 inputs
color=/*
size=/*
shape=/*
weight=/*

If user enters

color= red
size=/*
shape=/*
weight=/*

i want to have results like

red smth smth smth
red smth smth smth
red null null smth

But the color column is ALWAYS filled with red

next search
User enters

color= /*
size=Big
shape=/*
weight=/*

I get a table with
smth big smth smth
smth big smth Null
null big smth smth

0 Karma

493669
Super Champion

@alex_kh ,
Suppose when you search with Colour=Red and other field as *, then which events you are receiving and what events you are expecting to come as output?

0 Karma

alex_kh
Explorer

If i run my query with AND
color=$token1$ shape=$token2$ I either get no results or only results from the index which contains all fields

when i do the same stuff with OR
color=$token1$ OR shape=$token2$

I get smth like
red round
red square
yellow round
green triangle

0 Karma

493669
Super Champion

writing AND makes it compulsory to have both fields in events and making it OR makes either one of the field is present then also you will get results.
So what is your expected output?

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>