Splunk Search

How to get latest parameter from csv disregarding empty values

mishaaaaaaaaaa
Explorer

Hi splunk comunity!

I have dashboard with text input, which starts to execute when i change my parameter in text box, in query i write this parameter to my csv file.
In another dashboard i'm trying to read latest value of this parameter, but if i post an empty field in my first dashboard i get an empty result in my second.
So the question is how to check an empty value like method isEmpty() in java or how to ban empty fields passing to csv file in first dashboard?
Or how can i display last not empty value?

Tags (1)
0 Karma
1 Solution

renjith_nair
Legend

@mishaaaaaaaaaa ,

Either use | where isnotnull(field) while reading or check with isnotnull(field) or isnull(field) before writing,

Reference : https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/InformationalFunctions

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

@mishaaaaaaaaaa ,

Either use | where isnotnull(field) while reading or check with isnotnull(field) or isnull(field) before writing,

Reference : https://docs.splunk.com/Documentation/Splunk/7.2.4/SearchReference/InformationalFunctions

---
What goes around comes around. If it helps, hit it with Karma 🙂

mishaaaaaaaaaa
Explorer

@renjith.nair This doesn't work, i've already tryed something like this, but i still get an emty field in my second dushboard

| makeresults
| eval param="$firstParam$"
| eval parameter=if(isnull(param), 50, param)
| outputcsv append=true mishasTestParametrization.csv
| table parameter

| inputcsv mishasTestParametrization.csv
| stats latest(parameter) as latestParam

0 Karma

renjith_nair
Legend

in that case, it might not be null() but just an empty space , try adding this

if(isnull(param) OR param=="", 50, param)

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

mishaaaaaaaaaa
Explorer

@renjith.nair yes this works, but i understud that this is not what i want. I need to write to csv if my param is not empty and don't write if it's empty

0 Karma

renjith_nair
Legend

@mishaaaaaaaaaa ,
Same can be used in the outputlookup as well. Taking your example

| makeresults
| eval param="$firstParam$"
| where param!="" AND isnotnull(param)
| outputcsv append=true mishasTestParametrization.csv
---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma

mishaaaaaaaaaa
Explorer

thanks a lot, that works perfect!

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Event Series: Splunk Observability Metrics Cost Optimization

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...

Deep insights, no barriers: Splunk Observability Cloud Free Edition

As software delivery cycles continue to accelerate, observability shouldn’t be a luxury — it should be a ...