Exclusion of values on dashboard- How to fix this?

[sahana]

Hi,

I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL.

Based on the above selection I have an panel that shows the success / failure counts graphs will appear.

The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values.

So, can you help on fixing this issue??

Thanks,

Sahana 

[ITWhisperer]

Can you share the search that is giving you this issue?

[sahana]

@ITWhisperer 

The search is 

index=123245 envId=* countryCode=$selected_Country$ httpserviceStatus=500 OR  message.status=* Or message.abpsStatus =* appName!=Null | dedup requestId| eval status= case(like('httpServiceStatus'."%50%") OR like('message.status',"Failure")OR like('message.abpsStatus',"Failure") | eval Failures=if(status="Failure",1,0)|timeChart span=1h count(Failures) as Fail by countryCode

The selected_Country will pass values like(SG,Hk,MY,ID) but somehow we are getting graphs for (null, Value,Other) values also

So I am in need that the query should show the graphs for these countries alone based on selection SG,Hk,MY,ID and should ignore other values if I selected *(ALL) in the selected_Country token

[ITWhisperer]

Are you getting the issue when you select a single country e.g. "SG" or only when you select all countries "*"?

[sahana]

@ITWhisperer 

In both the cases we are getting the "null"

but when I select All i am getting all the un wanted values

[ITWhisperer]

limit=0 should get rid of OTHER and usenull=f should get rid of NULL

|timeChart limit=0 span=1h count(Failures) as Fail by countryCode usenull=f

[sahana]

@ITWhisperer 

But I am getting values like ('VALUE',38,18 ) also in the same graphs

[ITWhisperer]

Is countryCode a multi-value field?