Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- space in values does not filter data
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have data coming in where I have a field called Result which holds data as below
1) "FAIL"
2) " FAIL "
3) "PASS"
4) " PASS "
now i have created a dashboard where the Result field is used in Drop down box. I have cleared the extra space from the field using
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@koreamit3483 wrote:I have data coming in where I have a field called Result which holds data as below
1) "FAIL"
2) " FAIL "
3) "PASS"
4) " PASS "
now i have created a dashboard where the Result field is used in Drop down box. I have cleared the extra space from the field using
| rex mode = sed field=Result "s/ //g"|in dropdown values.
I have a data also showing on dashboard using the count as
stats count(eval(searchmatch("PASS"))) AS PASS count(eval(searchmatch("FAIL"))) AS FAILwhich also have cleared the space using
| rex mode = sed field=Result "s/ //g"|but when I select "PASS" or "FAIL" in drop down and submit the data on dashboard, it excludes the data which has values with space in it (i.e. " FAIL " and " PASS ") and shows only the values without space.
How can I solve this.
(Nested Spoiler tags make the question very difficult to read. Additionally, if you illustrate actual search terms in your dashboard search, the question will be much clearer; specifically, illustrate how the dropdown token is being used in the search.)
Suppose your dropdown token is $results_tok$ and your dashboard search is something like
Results = $results_tok$ blah
``` token used in base search without modification will fail to capture events with space in Results ```
| stats blah
it will only get events without space. This is expected.
@Gr0und_Z3r0 suggests using "*" wildcard. It should work in base search, e.g.,
Results = $results_tok$* blah
| stats blah
In short, you need to illustrate sanitized search code for others to diagnose a problem.
Here is an emulation of the solution suggested by Gr0und_Z3r0.
| makeresults count=16 ``` emulating raw events ```
| streamstats count
| eval Result = if(count % 2 == 0, "PASS", "FAIL")
| eval Result = if(count % 4 == 0, Result . " ", Result)
| eval result = ">" . Result . "<"
``` the following emulates base search where dropdown token value is "PASS" ```
| search Result = PASS*
The result includes both "PASS" and "PASS "
| Result | _time | count | result |
| PASS | 2021-12-02 00:54:03 | 2 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 4 | >PASS < |
| PASS | 2021-12-02 00:54:03 | 6 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 8 | >PASS < |
| PASS | 2021-12-02 00:54:03 | 10 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 12 | >PASS < |
| PASS | 2021-12-02 00:54:03 | 14 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 16 | >PASS < |
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Use |search result=*PASS* OR result=*FAIL* accordingly
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Tried this doing but still not filtering data over dashboard.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@koreamit3483 wrote:I have data coming in where I have a field called Result which holds data as below
1) "FAIL"
2) " FAIL "
3) "PASS"
4) " PASS "
now i have created a dashboard where the Result field is used in Drop down box. I have cleared the extra space from the field using
| rex mode = sed field=Result "s/ //g"|in dropdown values.
I have a data also showing on dashboard using the count as
stats count(eval(searchmatch("PASS"))) AS PASS count(eval(searchmatch("FAIL"))) AS FAILwhich also have cleared the space using
| rex mode = sed field=Result "s/ //g"|but when I select "PASS" or "FAIL" in drop down and submit the data on dashboard, it excludes the data which has values with space in it (i.e. " FAIL " and " PASS ") and shows only the values without space.
How can I solve this.
(Nested Spoiler tags make the question very difficult to read. Additionally, if you illustrate actual search terms in your dashboard search, the question will be much clearer; specifically, illustrate how the dropdown token is being used in the search.)
Suppose your dropdown token is $results_tok$ and your dashboard search is something like
Results = $results_tok$ blah
``` token used in base search without modification will fail to capture events with space in Results ```
| stats blah
it will only get events without space. This is expected.
@Gr0und_Z3r0 suggests using "*" wildcard. It should work in base search, e.g.,
Results = $results_tok$* blah
| stats blah
In short, you need to illustrate sanitized search code for others to diagnose a problem.
Here is an emulation of the solution suggested by Gr0und_Z3r0.
| makeresults count=16 ``` emulating raw events ```
| streamstats count
| eval Result = if(count % 2 == 0, "PASS", "FAIL")
| eval Result = if(count % 4 == 0, Result . " ", Result)
| eval result = ">" . Result . "<"
``` the following emulates base search where dropdown token value is "PASS" ```
| search Result = PASS*
The result includes both "PASS" and "PASS "
| Result | _time | count | result |
| PASS | 2021-12-02 00:54:03 | 2 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 4 | >PASS < |
| PASS | 2021-12-02 00:54:03 | 6 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 8 | >PASS < |
| PASS | 2021-12-02 00:54:03 | 10 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 12 | >PASS < |
| PASS | 2021-12-02 00:54:03 | 14 | >PASS< |
| PASS | 2021-12-02 00:54:03 | 16 | >PASS < |
Splunk Answers Content Calendar, July Edition I
Secure Your Future: Mastering Upgrade Readiness for Splunk 10
Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM
