Dashboards & Visualizations

help on a dropdown list static option for empty field

jip31
Motivator

Hi
In a dashboard I use a doropdown list
the dropdown list is updated like this :
| inputlookup toto.csv
| fields SITE
| dedup SITE
| table SITE
| sort +SITE

Then, I use the search below in order to be able to filter the search results by SITE
it works, but I also want to be able to display the hosts from host.csv which have no SITE in toto.csv because sometimes this field is empty
what I have to add in the static option to do this please?

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

thanks

Tags (1)
0 Karma
1 Solution

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

View solution in original post

0 Karma

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

0 Karma

jip31
Motivator

thanks for your answer

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...