Splunk Search

Exclusion of values on dashboard- How to fix this?

sahana
Engager

Hi,

I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL.

Based on the above selection I have an panel that shows the success / failure counts graphs will appear.

The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values.

So, can you help on fixing this issue??

Thanks,

Sahana 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share the search that is giving you this issue?

0 Karma

sahana
Engager

@ITWhisperer 

The search is 

index=123245 envId=* countryCode=$selected_Country$ httpserviceStatus=500 OR  message.status=* Or message.abpsStatus =* appName!=Null | dedup requestId| eval status= case(like('httpServiceStatus'."%50%") OR like('message.status',"Failure")OR like('message.abpsStatus',"Failure") | eval Failures=if(status="Failure",1,0)|timeChart span=1h count(Failures) as Fail by countryCode

 

The selected_Country will pass values like(SG,Hk,MY,ID) but somehow we are getting graphs for (null, Value,Other) values also

 

So I am in need that the query should show the graphs for these countries alone based on selection SG,Hk,MY,ID and should ignore other values if I selected *(ALL) in the selected_Country token

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you getting the issue when you select a single country e.g. "SG" or only when you select all countries "*"?

0 Karma

sahana
Engager

@ITWhisperer 

In both the cases we are getting the "null"

but when I select All i am getting all the un wanted values

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

limit=0 should get rid of OTHER and usenull=f should get rid of NULL

|timeChart limit=0 span=1h count(Failures) as Fail by countryCode usenull=f
0 Karma

sahana
Engager

@ITWhisperer 

But I am getting values like ('VALUE',38,18 ) also in the same graphs

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is countryCode a multi-value field?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...