Dashboards & Visualizations

help on a dropdown list static option for empty field

jip31
Motivator

Hi
In a dashboard I use a doropdown list
the dropdown list is updated like this :
| inputlookup toto.csv
| fields SITE
| dedup SITE
| table SITE
| sort +SITE

Then, I use the search below in order to be able to filter the search results by SITE
it works, but I also want to be able to display the hosts from host.csv which have no SITE in toto.csv because sometimes this field is empty
what I have to add in the static option to do this please?

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

thanks

Tags (1)
0 Karma
1 Solution

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

View solution in original post

0 Karma

KARANMALHOTRA
Path Finder

You can use fillnull to assign a dummy SITE value (like blank) to the output after the lookup with the toto.csv file.

And then add a static N/A value to your first filter. So when you select blank in the filter, the search will consider all hosts without SITE.

| inputlookup host.csv 
| lookup patchlevel.csv "Computer" as host 
| lookup toto.csv HOSTNAME as host output SITE 
| fillnull SITE value="blank"
| search SITE=$tok_filtersite|s$ 
| stats count(flag_patch_version)

see fillnull documentation here

0 Karma

jip31
Motivator

thanks for your answer

0 Karma
Get Updates on the Splunk Community!

Cultivate Your Career Growth with Fresh Splunk Training

Growth doesn’t just happen—it’s nurtured. Like tending a garden, developing your Splunk skills takes the right ...

Introducing a Smarter Way to Discover Apps on Splunkbase

We’re excited to announce the launch of a foundational enhancement to Splunkbase: App Tiering.  Because we’ve ...

How to Send Splunk Observability Alerts to Webex teams in Minutes

As a Developer Evangelist at Splunk, my team and I are constantly tinkering with technology to explore its ...