Dashboards & Visualizations

How do you exclude empty inputs from a search?

New Member

I created a dashboard with 4 text inputs and added in the end next query:

where like(credentials, "%$credentials$%") OR like(host, "%$host$%") OR like(okato, "%$okato$%") OR where like(command, "%$command$%")

So I need to exclude empty fields from the query. How do I make it? I need it because, if I have at least one empty, the search returns everything. I want to use every part of like, only if, the input for field has value.

0 Karma

Path Finder

Adjust AND (default) or OR as you needed and try adding to the search field=*, in your case similar to:

credentials=* host=* okato=* command=* | where like(credentials, "%$credentials$%") OR like(host, "%$host$%") OR like(okato, "%$okato$%") OR where like(command, "%$command$%")

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!