Dashboards & Visualizations

How to make dropdown select filter "need all to include null"?

maxsteel
Explorer

I am trying to create a dashboard that has a dropdown input eg:

    <input type="dropdown" token="HWStat" searchWhenChanged="true">
        <label>HW Status</label>
        <choice value="*">All</choice>
        <choice value="Installed">Installed</choice>
        <default>*</default>
        <initialValue>*</initialValue>
    </input>
 
This was the easier part.
 
Now when I go to use the token $HWStat$ it's just fine for passing the "Installed" option to the search.
 
However, the asterisk "*" option for all when passed only displays results with values.  I know there are a lot of "null" values in there as well that I would like the output to display.  Also there appears to be some with "blanks" as well.
(I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank).
 
basic search I was testing:
ending with:
| stats ...
| search hw_stat_column=$HWStat$
 
What is the better option to pass other than "*" to capture everything?  I've scoured the internet, and this is not an easy thing to search for.  Thanks in advance!
Labels (1)
0 Karma
1 Solution

andrew_nelson
Communicator

Oh, sorry, I missed that part. 

You can check if the length of the value is over a certain length and if it isn't, set it to null. Then fillnull : 

| eval hw_stat_column=if(len(hw_stat_column) > 2, hw_stat_column, null())
| fillnull value="N/A" hw_stat_column

View solution in original post

andrew_nelson
Communicator

Easiest way to get around it is using fillnull in your search after your stats. 

| fillnull value="N/A" hw_stat_column

0 Karma

maxsteel
Explorer

in my OP I mentioned:
(I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank).

and wasn't displaying those..

0 Karma

andrew_nelson
Communicator

Oh, sorry, I missed that part. 

You can check if the length of the value is over a certain length and if it isn't, set it to null. Then fillnull : 

| eval hw_stat_column=if(len(hw_stat_column) > 2, hw_stat_column, null())
| fillnull value="N/A" hw_stat_column

maxsteel
Explorer

(no worries, I appreciate the help)
I tried this but didn't really like it:

Here's the high level of what I tried:

| stats ...
| eval hw_stat_column=if(len(hw_stat_column> 2), hw_stat_column, null())
| fillnull value="N/A" hw_stat_column
| search hw_stat_column=$HWStat$
 
got this:
 Error in 'EvalCommand': The arguments to the 'len' function are invalid.
0 Karma

andrew_nelson
Communicator

I had the closing parenthesis for len() in the wrong place. My bad. I've updated it above.

0 Karma

maxsteel
Explorer

oh boy, I should have caught that too.. d'oh!  Thanks for your help, this now appears to work as expected.

I would have preferred to have been able to keep the blanks in the table I created as it was sourced from 4 different datasources, and the blanks were much easier to see when there were issues to be 'spotted'.  But alas, like all data, nulls and spaces are our worst enemies, so massaging to things like N/A are needed....

too bad "*" didn't just work for ALL and ANYTHING 🙂

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...