Dashboards & Visualizations

help on a dropdown list static option for empty field

jip31
Motivator

Hi
In a dashboard I use a doropdown list
the dropdown list is updated like this :
| inputlookup toto.csv
| fields SITE
| dedup SITE
| table SITE
| sort +SITE

Then, I use the search below in order to be able to filter the search results by SITE
it works, but I also want to be able to display the hosts from host.csv which have no SITE in toto.csv because sometimes this field is empty
what I have to add in the static option to do this please?

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

thanks

Tags (1)
0 Karma
1 Solution

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

View solution in original post

0 Karma

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

0 Karma

jip31
Motivator

thanks for your answer

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...