Splunk Search

Exclusion of values on dashboard- How to fix this?

sahana
Engager

Hi,

I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL.

Based on the above selection I have an panel that shows the success / failure counts graphs will appear.

The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values.

So, can you help on fixing this issue??

Thanks,

Sahana 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share the search that is giving you this issue?

0 Karma

sahana
Engager

@ITWhisperer 

The search is 

index=123245 envId=* countryCode=$selected_Country$ httpserviceStatus=500 OR  message.status=* Or message.abpsStatus =* appName!=Null | dedup requestId| eval status= case(like('httpServiceStatus'."%50%") OR like('message.status',"Failure")OR like('message.abpsStatus',"Failure") | eval Failures=if(status="Failure",1,0)|timeChart span=1h count(Failures) as Fail by countryCode

 

The selected_Country will pass values like(SG,Hk,MY,ID) but somehow we are getting graphs for (null, Value,Other) values also

 

So I am in need that the query should show the graphs for these countries alone based on selection SG,Hk,MY,ID and should ignore other values if I selected *(ALL) in the selected_Country token

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you getting the issue when you select a single country e.g. "SG" or only when you select all countries "*"?

0 Karma

sahana
Engager

@ITWhisperer 

In both the cases we are getting the "null"

but when I select All i am getting all the un wanted values

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

limit=0 should get rid of OTHER and usenull=f should get rid of NULL

|timeChart limit=0 span=1h count(Failures) as Fail by countryCode usenull=f
0 Karma

sahana
Engager

@ITWhisperer 

But I am getting values like ('VALUE',38,18 ) also in the same graphs

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is countryCode a multi-value field?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...