Here is my multiselect code for the input:
<input type="multiselect" token="tok_ABCName" searchWhenChanged="true">
<label>ABC Name</label>
<default>All</default>
<prefix>(</prefix>
<valuePrefix>ABCName="</valuePrefix>
<valueSuffix>"</valueSuffix>
<delimiter>OR</delimiter>
<suffix>)</suffix>
<choice value="*">All</choice>
<fieldForLabel>ABC Name</fieldForLabel>
<fieldForValue>ABCName</fieldForValue>
Here is my main query:
| inputlookup Names_Software_R.csv | rename "ABC Name" as ABCName | search $tok_ABCName$ | values(ABCName) as "ABC Name" by ServerName
Have you tried fillnull for your ABCName field.? Also note that, stats values will not include nulls or duplicates.
@ITWhisperer Thanks, the fillnull seems to have solved the issue for now. I will revisit my original CSV files to ensure I have all 400 and something servers coming up in my query. I basically just did | fillnull value=NULL before the search command.
Hi @ITWhisperer
yes, there is a stats command in front of my query. My question is that I have a csv that was imported into Splunk. I can query everything just fine, but my csv has 400 servers and I am only getting a count of 91. This is due to the missing rows of data from my original CSV. Is there a way I can work around the missing cells so that I can get the original count of 400 servers from my CSV?
Have you tried fillnull for your ABCName field.? Also note that, stats values will not include nulls or duplicates.
Your main query doesn't look complete (presumably there is at least a stats command in front of the values(ABCName)?), but more to the point, what is your question?