Hi,
I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL.
Based on the above selection I have an panel that shows the success / failure counts graphs will appear.
The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values.
So, can you help on fixing this issue??
Thanks,
Sahana
Can you share the search that is giving you this issue?
The search is
index=123245 envId=* countryCode=$selected_Country$ httpserviceStatus=500 OR message.status=* Or message.abpsStatus =* appName!=Null | dedup requestId| eval status= case(like('httpServiceStatus'."%50%") OR like('message.status',"Failure")OR like('message.abpsStatus',"Failure") | eval Failures=if(status="Failure",1,0)|timeChart span=1h count(Failures) as Fail by countryCode
The selected_Country will pass values like(SG,Hk,MY,ID) but somehow we are getting graphs for (null, Value,Other) values also
So I am in need that the query should show the graphs for these countries alone based on selection SG,Hk,MY,ID and should ignore other values if I selected *(ALL) in the selected_Country token
Are you getting the issue when you select a single country e.g. "SG" or only when you select all countries "*"?
In both the cases we are getting the "null"
but when I select All i am getting all the un wanted values
limit=0 should get rid of OTHER and usenull=f should get rid of NULL
|timeChart limit=0 span=1h count(Failures) as Fail by countryCode usenull=f
Is countryCode a multi-value field?