Splunk Dashboard drilldown: How to replace "NULL" with isnull(myfield) in a drilldown search?

[gunnist]

The search behind my chart:

index="myindex" | ... | timechart count by AnimalTypes (the problem is that AnimalTypes sometimes doesn't exist)

My dashboard displays the following Legend:

- cats

- dogs

- NULL (because sometimes AnimalTypes doesn't exist)

Drilldown search:

index="myindex" | ... | search AnimalTypes=$click.name2$

If I click my dashboard for cats or dogs, it works fine , but when I click the NULL barchart, my clickdown search becomes:

index="myindex" | .. | search AnimalTypes=NULL 

(doesn't work)

But it want the search to look like this (which works):

index="myindex" | ... | where isnull(AnimalTypes) 

How do I do this? 🙂

[ITWhisperer]

In your drilldown, you should evaluate a token dependent on the value of $click.name2$ and use the new token in the search

<eval token="AnimalTypesSearch">if("$click.name2$"="NULL","isnull(AnimalTypes)","AnimalTypes=$click.name2|s$")</eval>

index="myindex" | ... | where $AnimalTypesSearch$

Also note the switch to using where rather than search so that isnull function becomes valid

[maxsteel]

@ITWhisperer 

I have a very similar thing going on, I can get the eval in the drilldown to work when I have a static value, however, it does not like when I have a variable in the 'false'
 

in this example it would be the 

"AnimalTypes=$click.name2|s$"

part.  It is not substituting $click.value$ in my case (you have $click.name2|s$) with the value, it is sending the $click. Value$ parameter to the search..

thoughts?

[maxsteel]

To help others, I figured it out, the false result to have text and a token looks like:
"AnimalTypes=".$click.value$

Notice the "s around the text and the . (dot) between the token.

[gunnist]

Hi,

Thanks, but where do I put the:

"<eval token="AnimalTypesSearch">....."

[ITWhisperer]

In the drilldown of the panel which you are clicking on.

[somesoni2]

Give this a try:

Drilldown search:

index="myindex" | ... | where AnimalTypes=if("$click.name2$"="NULL","","$click.name2$")

[gunnist]

Then I get  (when I click on the "NULL" legend in the chart):

index="myindex" | ... | where AnimalTypes=if("NULL"="NULL","","NULL")