Dashboards & Visualizations

How to include the events even with the not present field when selecting All in the dashboard?

VatsalJagani
SplunkTrust
SplunkTrust

How to include the events even with the not present field when selecting All in the dashboard?

Explanation:

  • I have got a dashboard where there are two dropdown inputs. (Ex. Input A and Input B).
  • Input B is being populated with a lookup with fields like a, b, c, etc.
  • Now there are some entries in the lookup where field a is not present (null).  And all those entries are never visible in the dashboard.
  • Reason: Query of Input B is like: 

 

| inputlookup mylookup | search a="$tkn_A$" | table b, c

 

  • So, even when I select the value "All" (*) for Input A, these values still don't show. 

How can I show these values in the filter when "All"(*) is selected in Input A?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

View solution in original post

0 Karma

niketn
Legend

@VatsalJagani how about the following

| inputlookup test.csv where a="$tkn_A$" OR b="*"
| fields a b c

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Clarifying a bit more:

On change of Input A:

<eval token="tkn_A">if($a$="*"," ","a=".$a$)</eval>

 

Search Query Change, from:  a=$a$ to $tkn_A|s$

0 Karma
Get Updates on the Splunk Community!

Earn a $35 Gift Card for Answering our Splunk Admins & App Developer Survey

Survey for Splunk Admins and App Developers is open now! | Earn a $35 gift card!      Hello there,  Splunk ...

Continuing Innovation & New Integrations Unlock Full Stack Observability For Your ...

You’ve probably heard the latest about AppDynamics joining the Splunk Observability portfolio, deepening our ...

Monitoring Amazon Elastic Kubernetes Service (EKS)

As we’ve seen, integrating Kubernetes environments with Splunk Observability Cloud is a quick and easy way to ...