Splunk Search
Highlighted

searching the records of the table with empty field

Path Finder

Hi
I have an interactive dashboard with form inputs, i have set default value as * for all the form inputs, depends on the input value/values my search has to execute and matched records of the Table has to display in my panel.If any form input is not given,it can take any value including null/empty. If a particular Field of the table is completely empty, search displays "no record found". what is the default value i have to set so that i can get the records of the table eventhough a particular field is empty.

Tags (2)
Highlighted

Re: searching the records of the table with empty field

Legend

There is no default value that you can set - you will have to take this into account in the search string itself.

0 Karma
Highlighted

Re: searching the records of the table with empty field

Path Finder

I referred the below link for assigning default value as "" for my form inputs.http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/Buildandeditforms
We assumed that "
" takes any non-zero value and execute the search wheras we get "No results found" if any of the field in the log has empty value.Can you please clarify what does "*" means here

0 Karma
Highlighted

Re: searching the records of the table with empty field

SplunkTrust
SplunkTrust

The default value you set as "" is correct, but the term * will not match any NULL values. You would have to build appropriate filters within your search to ensure that if "" is selected in form input (or no selection of input value with default as "*"), it matches NULL/Empty field values as well.

Something like this

Your base search ... | eval field1=coalesce(field1,"NA") | search field1=$inputForField1$ 

View solution in original post

Highlighted

Re: searching the records of the table with empty field

New Member

@somesoni2 how do we do this, if we have like multiple inputs which are likely to have NULL values. I tried my hand with fillnull, it works but the search results come back too slow and delayed. 

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.