Splunk Search

Exclusion of values on dashboard- How to fix this?

sahana
Engager

Hi,

I have an filter for selecting the country values, provided this as a drop down. we have options like singapore,malaysia,china,vietnam and also have an option of ALL.

Based on the above selection I have an panel that shows the success / failure counts graphs will appear.

The issue I am facing is I am getting the values like(Null,Value,Other,18,38) in countryCode column if I run the dashboard. But I don't see any event with the countryCode parameter having this values.

So, can you help on fixing this issue??

Thanks,

Sahana 

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share the search that is giving you this issue?

0 Karma

sahana
Engager

@ITWhisperer 

The search is 

index=123245 envId=* countryCode=$selected_Country$ httpserviceStatus=500 OR  message.status=* Or message.abpsStatus =* appName!=Null | dedup requestId| eval status= case(like('httpServiceStatus'."%50%") OR like('message.status',"Failure")OR like('message.abpsStatus',"Failure") | eval Failures=if(status="Failure",1,0)|timeChart span=1h count(Failures) as Fail by countryCode

 

The selected_Country will pass values like(SG,Hk,MY,ID) but somehow we are getting graphs for (null, Value,Other) values also

 

So I am in need that the query should show the graphs for these countries alone based on selection SG,Hk,MY,ID and should ignore other values if I selected *(ALL) in the selected_Country token

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Are you getting the issue when you select a single country e.g. "SG" or only when you select all countries "*"?

0 Karma

sahana
Engager

@ITWhisperer 

In both the cases we are getting the "null"

but when I select All i am getting all the un wanted values

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

limit=0 should get rid of OTHER and usenull=f should get rid of NULL

|timeChart limit=0 span=1h count(Failures) as Fail by countryCode usenull=f
0 Karma

sahana
Engager

@ITWhisperer 

But I am getting values like ('VALUE',38,18 ) also in the same graphs

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is countryCode a multi-value field?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...