how to display value for a filed if it has no value?

[AzmathShaik]

Hello All,

i have a dashboard where in drop down am displaying values for user index=user_stats | stats count by user. i have a problem where some log events has user value as below user = (user has no value) so in drop down, instead of blank space i want to display as some value say null or no_user so user can select that value to see all results which has blank value for user attribute
can any one help me in it

My drop down query:

index=user_stats sourctype=user_accounts | stats count by user

My panel query

index=user_stats sourctype=user_accounts $user$

[s2_splunk]

Try this index=user_stats sourcetype=user_accounts | eval user=if(isnull(user),"No_user", user) | stats count by user for your populating search
Then in your panel search, try index=user_stats sourcetype=user_accounts | eval SrchUser = if( $user$="No_user", undefField, $user$) | search user=SrchUser
Make sure "undefField" is a fieldname that you know won't exist; that should result in searching for a null user if No_user was selected

[gcusello]

hi AzmathShaik,
did you tried with fillnull command?
Bye.
Giuseppe

[AzmathShaik]

yeah i tried as below

index=user_stats sourctype=user_accounts | fillnull value=no_user user |stats count by user
but no luck