Dashboards & Visualizations

How to handle non existing fields in multi select

shikhanshu
Path Finder

Hi, I have a dashboard with an input element which is a multi-select with a populating search which gets values for the token. The value prefix is

fieldname=" 

and value suffix is

"

I also have a default value of * (with label as All)

So when the user selects All, the token value becomes

fieldname="*"

That's a problem. What I really want to mean by All is, get all records with or without "fieldname". The above value filters out the records in which fieldname is null and I don't want that.

How can I tweak this so that:
1. When user chooses All, the token gets empty string as a value (how is it possible since I have a prefix and suffix)
2. OR, when user chooses All, the token gets value as fieldname="*" OR fieldname="" . That will take care of both null and not null situations.

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

My Suggestion would be add a "Calculated field" for the fieldname used by multiselect. something like this

props.conf

EVAL-fieldname = coalesce(fieldname,"")

This way your fieldname will either have valid value or will have blanks "" and in both cases fieldname="*" will pick that up.

View solution in original post

shikhanshu
Path Finder

This does work. Although I don't have access to props.conf (IT maintained Splunk instance), I am able to use eval command in my search and get this going. Thanks!

Can you make this comment as an answer?

0 Karma

somesoni2
Revered Legend

You can add calculated fields from Splunk UI as well. Go to Settings->Fields -> Calculated fields .

0 Karma

somesoni2
Revered Legend

My Suggestion would be add a "Calculated field" for the fieldname used by multiselect. something like this

props.conf

EVAL-fieldname = coalesce(fieldname,"")

This way your fieldname will either have valid value or will have blanks "" and in both cases fieldname="*" will pick that up.

Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...