Splunk Search
Highlighted

How to edit multiselect token to include a field with a null value?

Explorer

I have a multiselect box on a field-- modelName

modelName can have different values or empty value.
eg. modelName="modelA" modelName="modelB" or modelName=""

modelName="*"

I set the default multiselect token to "*" to select all of the records. But it will ignore modelName=""(the null case)
Is there anyway to include the null case?
Thanks.

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Splunk Employee
Splunk Employee

Search has long lacked a good way to distinguish between a field that is not present vs a field that is present but has an empty-string value for the current record.

What I've generally had to do is (modelName="*" OR modelName="")

This isn't a full answer because it doesn't tell you how to handle this in a view. Sorry I'm not sure.

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Legend

Hi kualo,
I generally use

(modelName="*" OR NOT modelName="*")

Bye.
Giuseppe

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Engager

I'm still a bit confused on this one, can someone please assist? I am trying to populate null values in a multiselect box. My current code is:

    Search=1337 | stats count by UserBuilding  | table UserBuilding

Right now, I am getting all entries with a value as a selection, but not the null values... Not sure what I am doing wrong. Any help is appreciated.

Thanks!

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Ultra Champion

Hi, @jregruit

stats by remove null values.

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Engager

What should my syntax be here?

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Ultra Champion

I don't think your query is wrong.
What do you want to populate?
null means nothing

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Engager

In my multiselect checkbox, I would like to have a option for occurrences of null values.

0 Karma
Highlighted

Re: How to edit multiselect token to include a field with a null value?

Ultra Champion
Search=1337 
| eval UserBuilding=coalesce(UserBuilding, "nothing")
| stats count by UserBuilding
| table UserBuilding

try this, @jregruit

Highlighted

Re: How to edit multiselect token to include a field with a null value?

Engager

That will work, thank you!

0 Karma