Dashboards & Visualizations
Highlighted

how to display value for a filed if it has no value?

Path Finder

Hello All,

i have a dashboard where in drop down am displaying values for user index=user_stats | stats count by user. i have a problem where some log events has user value as below user = (user has no value) so in drop down, instead of blank space i want to display as some value say null or no_user so user can select that value to see all results which has blank value for user attribute
can any one help me in it

My drop down query:

index=userstats sourctype=useraccounts | stats count by user

My panel query

index=userstats sourctype=useraccounts $user$

0 Karma
Highlighted

Re: how to display value for a filed if it has no value?

Legend

hi AzmathShaik,
did you tried with fillnull command?
Bye.
Giuseppe

0 Karma
Highlighted

Re: how to display value for a filed if it has no value?

Path Finder

yeah i tried as below

index=userstats sourctype=useraccounts | fillnull value=no_user user |stats count by user
but no luck

0 Karma
Highlighted

Re: how to display value for a filed if it has no value?

Splunk Employee
Splunk Employee

Try this index=user_stats sourcetype=user_accounts | eval user=if(isnull(user),"No_user", user) | stats count by user for your populating search
Then in your panel search, try index=user_stats sourcetype=user_accounts | eval SrchUser = if( $user$="No_user", undefField, $user$) | search user=SrchUser
Make sure "undefField" is a fieldname that you know won't exist; that should result in searching for a null user if No_user was selected

0 Karma