Dashboards & Visualizations

How to include the events even with the not present field when selecting All in the dashboard?

VatsalJagani
SplunkTrust
SplunkTrust

How to include the events even with the not present field when selecting All in the dashboard?

Explanation:

  • I have got a dashboard where there are two dropdown inputs. (Ex. Input A and Input B).
  • Input B is being populated with a lookup with fields like a, b, c, etc.
  • Now there are some entries in the lookup where field a is not present (null).  And all those entries are never visible in the dashboard.
  • Reason: Query of Input B is like: 

 

| inputlookup mylookup | search a="$tkn_A$" | table b, c

 

  • So, even when I select the value "All" (*) for Input A, these values still don't show. 

How can I show these values in the filter when "All"(*) is selected in Input A?

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

View solution in original post

0 Karma

niketn
Legend

@VatsalJagani how about the following

| inputlookup test.csv where a="$tkn_A$" OR b="*"
| fields a b c

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

ITWhisperer
SplunkTrust
SplunkTrust

Fields with value null do not equate to anything so

...
| search a=*
...

will find all instances where a is not null

Can you change tkn_A so that it includes the a=, something along these lines

...
<eval token="tkn_A">if(someotherfield="*","","a="+someotherfield)</eval>
...

 Then change your search to

...
| search $tkn_A$
...

 

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Clarifying a bit more:

On change of Input A:

<eval token="tkn_A">if($a$="*"," ","a=".$a$)</eval>

 

Search Query Change, from:  a=$a$ to $tkn_A|s$

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...