Dashboards & Visualizations

How to build a multi-input dashboard and ignore inputs that are left blank?

Glasses
Builder

Hi 

I am trying to build a multi-input textbox dashboard based on a KVstore lookup.

My query is like this

 

| inputlookup <some-host-detail-kvlookup>
| search $computer_name$ OR $computer_number$ OR $computer_id$
| fields computerName computerNumber ComputerId ... 

 

each token has a prefix i.e. <fieldName> =  (which is the column header field in the lookup)

each token also has an initial value = null 

thus the query runs like this 

 

 

| search computerName=null OR computerNumber=null OR ComputerId=null

| search computerName=FOO  OR computerNumber=null OR ComputerId=null

 

 

as you can see setting  the <fieldName> to null allows the search to run without breaking, but after a user enters FOO for the computerName value, they need to reset the blank search inputs back to null.   Otherwise if a blank is passed like 

 

| search computerName= OR computerNumber=null OR ComputerId=null

 

the search breaks.

 

Any suggestions how to ignore the empty inputs or a way to reset the initial values to null again is greatly appreciated.  OR if anyone has a suggestion to do this another way, I would very much like to hear.

Thank you

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...