Dashboards & Visualizations

In Simple XML, have * as default text input value is causing incorrect results.

lyndac
Contributor

I am using splunk 6.3.1. My data is indexed as JSON. Not all fields will have a value. For example, 2 (very simplified events) could look like this:

{
  "host":"hostname",
  "field2":"pickle",
  "field3":  "onion"
}
{
  "host": "host2",
  "field2": "pickachu"
}

I have a dashboard form (simple xml) that allows the user to use text fields to filter their results. Currently I have the default value for each of the text fields set to an asterick . If the user only enters a value for host, and field 2, the token for field3 gets set to *

index=foo host="hostofmine" field2="pic*" field3="*" | stats count by host

Since field 3 is an optional field (it may or may not be in the raw json document), having a default value of * causes my search to return incomplete results. For the simple data above, only 1 event will be returned, but I would like both events to return. I tried just removing the default value, but the search doesn't execute unless I type something into the text field.

How can I make it so that the user does not have to enter a value into all 3 text fields and only the fields where the user does enter a value are part of the search?

0 Karma
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

Hi @lyndac,
Take a look at this previous Answers post:
https://answers.splunk.com/answers/4911/evaluating-form-field-if-not-null.html

It discusses using a prefix and suffix around the field to handle cases where users do not input a value. See also this documentation, which includes details for prefix and suffix:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/PanelreferenceforSimplifiedXML#form
Hope this helps!

View solution in original post

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @lyndac,
Take a look at this previous Answers post:
https://answers.splunk.com/answers/4911/evaluating-form-field-if-not-null.html

It discusses using a prefix and suffix around the field to handle cases where users do not input a value. See also this documentation, which includes details for prefix and suffix:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/PanelreferenceforSimplifiedXML#form
Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...