Dashboards & Visualizations

How to make dropdown select filter "need all to include null"?

maxsteel
Explorer

I am trying to create a dashboard that has a dropdown input eg:

    <input type="dropdown" token="HWStat" searchWhenChanged="true">
        <label>HW Status</label>
        <choice value="*">All</choice>
        <choice value="Installed">Installed</choice>
        <default>*</default>
        <initialValue>*</initialValue>
    </input>
 
This was the easier part.
 
Now when I go to use the token $HWStat$ it's just fine for passing the "Installed" option to the search.
 
However, the asterisk "*" option for all when passed only displays results with values.  I know there are a lot of "null" values in there as well that I would like the output to display.  Also there appears to be some with "blanks" as well.
(I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank).
 
basic search I was testing:
ending with:
| stats ...
| search hw_stat_column=$HWStat$
 
What is the better option to pass other than "*" to capture everything?  I've scoured the internet, and this is not an easy thing to search for.  Thanks in advance!
Labels (1)
0 Karma
1 Solution

andrew_nelson
Path Finder

Oh, sorry, I missed that part. 

You can check if the length of the value is over a certain length and if it isn't, set it to null. Then fillnull : 

| eval hw_stat_column=if(len(hw_stat_column) > 2, hw_stat_column, null())
| fillnull value="N/A" hw_stat_column

View solution in original post

andrew_nelson
Path Finder

Easiest way to get around it is using fillnull in your search after your stats. 

| fillnull value="N/A" hw_stat_column

0 Karma

maxsteel
Explorer

in my OP I mentioned:
(I've tried to set all blank fields to null using fillnull, and some appear to be either a white space or blank).

and wasn't displaying those..

0 Karma

andrew_nelson
Path Finder

Oh, sorry, I missed that part. 

You can check if the length of the value is over a certain length and if it isn't, set it to null. Then fillnull : 

| eval hw_stat_column=if(len(hw_stat_column) > 2, hw_stat_column, null())
| fillnull value="N/A" hw_stat_column

maxsteel
Explorer

(no worries, I appreciate the help)
I tried this but didn't really like it:

Here's the high level of what I tried:

| stats ...
| eval hw_stat_column=if(len(hw_stat_column> 2), hw_stat_column, null())
| fillnull value="N/A" hw_stat_column
| search hw_stat_column=$HWStat$
 
got this:
 Error in 'EvalCommand': The arguments to the 'len' function are invalid.
0 Karma

andrew_nelson
Path Finder

I had the closing parenthesis for len() in the wrong place. My bad. I've updated it above.

0 Karma

maxsteel
Explorer

oh boy, I should have caught that too.. d'oh!  Thanks for your help, this now appears to work as expected.

I would have preferred to have been able to keep the blanks in the table I created as it was sourced from 4 different datasources, and the blanks were much easier to see when there were issues to be 'spotted'.  But alas, like all data, nulls and spaces are our worst enemies, so massaging to things like N/A are needed....

too bad "*" didn't just work for ALL and ANYTHING 🙂

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...