Dashboards & Visualizations

How to include the events even with the not present field when selecting All in the dashboard?

VatsalJagani
SplunkTrust
SplunkTrust

How to include the events even with the not present field when selecting All in the dashboard?

Explanation:

  • I have got a dashboard where there are two dropdown inputs. (Ex. Input A and Input B).
  • Input B is being populated with a lookup with fields like a, b, c, etc.
  • Now there are some entries in the lookup where field a is not present (null).  And all those entries are never visible in the dashboard.
  • Reason: Query of Input B is like: 

 

| inputlookup mylookup | search a="$tkn_A$" | table b, c

 

  • So, even when I select the value "All" (*) for Input A, these values still don't show. 

How can I show these values in the filter when "All"(*) is selected in Input A?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

View solution in original post

0 Karma

niketn
Legend

@VatsalJagani how about the following

| inputlookup test.csv where a="$tkn_A$" OR b="*"
| fields a b c

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Clarifying a bit more:

On change of Input A:

<eval token="tkn_A">if($a$="*"," ","a=".$a$)</eval>

 

Search Query Change, from:  a=$a$ to $tkn_A|s$

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...