Dashboards & Visualizations

How do I make one field mandatory?

alex_kh
Explorer

Hello everybody

I have a dashboard with 4 text inputs (Example: color, shape size, weight)

Splunk takes all these values and performs a search over 9 different indexes.

The problem is that some indexes don't contain all the fields.
for example

Index A has ALL fields
Index B has fields: size, shape and taste
Index C has fields:color, size, sound

that's why when i enter red asterix asterix asterix

i want to have all the events with color=red even if i get something like
red null big 80 indexY
red square small null indexX

by the next search i would define the shape=square as mandatory field
red square small null indexX
null square null null 80 indexZ

Is it somehow possible? maybe with a checkbox?

Tags (1)
0 Karma

493669
Super Champion

make field value as null whose value is not present like below-

|eval size=if(isnull(size),"NULL",size), shape=if(isnull(shape),"NULL",shape)
0 Karma

alex_kh
Explorer

I suppose you got me wrong.

I have 4 inputs
color=/*
size=/*
shape=/*
weight=/*

If user enters

color= red
size=/*
shape=/*
weight=/*

i want to have results like

red smth smth smth
red smth smth smth
red null null smth

But the color column is ALWAYS filled with red

next search
User enters

color= /*
size=Big
shape=/*
weight=/*

I get a table with
smth big smth smth
smth big smth Null
null big smth smth

0 Karma

493669
Super Champion

@alex_kh ,
Suppose when you search with Colour=Red and other field as *, then which events you are receiving and what events you are expecting to come as output?

0 Karma

alex_kh
Explorer

If i run my query with AND
color=$token1$ shape=$token2$ I either get no results or only results from the index which contains all fields

when i do the same stuff with OR
color=$token1$ OR shape=$token2$

I get smth like
red round
red square
yellow round
green triangle

0 Karma

493669
Super Champion

writing AND makes it compulsory to have both fields in events and making it OR makes either one of the field is present then also you will get results.
So what is your expected output?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...