Dashboards & Visualizations

How to include the events even with the not present field when selecting All in the dashboard?

VatsalJagani
SplunkTrust
SplunkTrust

How to include the events even with the not present field when selecting All in the dashboard?

Explanation:

  • I have got a dashboard where there are two dropdown inputs. (Ex. Input A and Input B).
  • Input B is being populated with a lookup with fields like a, b, c, etc.
  • Now there are some entries in the lookup where field a is not present (null).  And all those entries are never visible in the dashboard.
  • Reason: Query of Input B is like: 

 

| inputlookup mylookup | search a="$tkn_A$" | table b, c

 

  • So, even when I select the value "All" (*) for Input A, these values still don't show. 

How can I show these values in the filter when "All"(*) is selected in Input A?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

View solution in original post

0 Karma

niketn
Legend

@VatsalJagani how about the following

| inputlookup test.csv where a="$tkn_A$" OR b="*"
| fields a b c

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Clarifying a bit more:

On change of Input A:

<eval token="tkn_A">if($a$="*"," ","a=".$a$)</eval>

 

Search Query Change, from:  a=$a$ to $tkn_A|s$

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...