Dashboards & Visualizations

Input filter returning null values

vitorvmiguel
Explorer

Hi folks,

I'm building a dashboard with several multiple inputs, and i'm facing a trouble while filtering a field named "mensagem", because i want to display de null values, but when i use fillnull it generates a conflict between the search of the field "mensagem" and the fillnull command.
The querie i'm using below.

index="raw_internet" tipo="$tipo$" AND programa="$prgr$" AND codigo="$cder$" AND mensagem="$msgm$" AND servidor="$srvd$" AND codigoAcesso="$cdac$"| fillnull mensagem value="Nenhuma" | table _time, tipo, programa, mensagem, codigo, servidor

There's anyone there that can help me?

0 Karma
1 Solution

woodcock
Esteemed Legend

I do not believe that what you are describing can be true. I suspect the values are actually whitespace because it really doesn't make sense otherwise. If your search uses (and it does) AND mensagem="$msgm$", then there is NOTHING that can be passed in for token msgm that will allow events that do not have a value for field mensagem (i.e. "many [events with] null values") to return from the search because implied in that clause is the stipulation that field mensagem exists and has a value that is not NULL. You absolutely must be misinterpreting your search results.

View solution in original post

0 Karma

woodcock
Esteemed Legend

I do not believe that what you are describing can be true. I suspect the values are actually whitespace because it really doesn't make sense otherwise. If your search uses (and it does) AND mensagem="$msgm$", then there is NOTHING that can be passed in for token msgm that will allow events that do not have a value for field mensagem (i.e. "many [events with] null values") to return from the search because implied in that clause is the stipulation that field mensagem exists and has a value that is not NULL. You absolutely must be misinterpreting your search results.

0 Karma

vitorvmiguel
Explorer

So, if the values are whitespace how can i do the same thing? Instead of Null is whitespace? Can you send me one exemple? Sorry my english is far from perfect.

index="raw_internet" tipo="$tipo$" AND programa="$prgr$" AND codigo="$cder$" AND mensagem="$msgm$" AND servidor="$srvd$" AND codigoAcesso="$cdac$"| fillnull mensagem value="Nenhuma" | table _time, tipo, programa, mensagem, codigo, servidor

0 Karma

woodcock
Esteemed Legend

Assuming you are OK with the fact that your form, as it is written right now, will ALWAYS drop EVERY event that does not have a (non-NULL) value for each and every field that you are "filtering" (which I find VERY hard to believe), you can do it like this:

index="raw_internet" tipo="$tipo$" AND programa="$prgr$" AND codigo="$cder$" AND mensagem="$msgm$" AND servidor="$srvd$" AND codigoAcesso="$cdac$"| eval mensagem = if(match(mensagem, "^\s*$"), "Nenhuma", mensagem) | table _time, tipo, programa, mensagem, codigo, servidor

0 Karma

vitorvmiguel
Explorer

Thanks woodcock, i must be misusing something.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...