Dashboards & Visualizations

How to include the events even with the not present field when selecting All in the dashboard?

VatsalJagani
SplunkTrust
SplunkTrust

How to include the events even with the not present field when selecting All in the dashboard?

Explanation:

  • I have got a dashboard where there are two dropdown inputs. (Ex. Input A and Input B).
  • Input B is being populated with a lookup with fields like a, b, c, etc.
  • Now there are some entries in the lookup where field a is not present (null).  And all those entries are never visible in the dashboard.
  • Reason: Query of Input B is like: 

 

| inputlookup mylookup | search a="$tkn_A$" | table b, c

 

  • So, even when I select the value "All" (*) for Input A, these values still don't show. 

How can I show these values in the filter when "All"(*) is selected in Input A?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

View solution in original post

0 Karma

niketn
Legend

@VatsalJagani how about the following

| inputlookup test.csv where a="$tkn_A$" OR b="*"
| fields a b c

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Clarifying a bit more:

On change of Input A:

<eval token="tkn_A">if($a$="*"," ","a=".$a$)</eval>

 

Search Query Change, from:  a=$a$ to $tkn_A|s$

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...