Input filter returning null values

[vitorvmiguel]

Hi folks,

I'm building a dashboard with several multiple inputs, and i'm facing a trouble while filtering a field named "mensagem", because i want to display de null values, but when i use fillnull it generates a conflict between the search of the field "mensagem" and the fillnull command.
The querie i'm using below.

index="raw_internet" tipo="$tipo$" AND programa="$prgr$" AND codigo="$cder$" AND mensagem="$msgm$" AND servidor="$srvd$" AND codigoAcesso="$cdac$"| fillnull mensagem value="Nenhuma" | table _time, tipo, programa, mensagem, codigo, servidor

There's anyone there that can help me?

[woodcock · Accepted solution]

I do not believe that what you are describing can be true. I suspect the values are actually whitespace because it really doesn't make sense otherwise. If your search uses (and it does) AND mensagem="$msgm$", then there is NOTHING that can be passed in for token msgm that will allow events that do not have a value for field mensagem (i.e. "many [events with] null values") to return from the search because implied in that clause is the stipulation that field mensagem exists and has a value that is not NULL. You absolutely must be misinterpreting your search results.

[vitorvmiguel]

So, if the values are whitespace how can i do the same thing? Instead of Null is whitespace? Can you send me one exemple? Sorry my english is far from perfect.

index="raw_internet" tipo="$tipo$" AND programa="$prgr$" AND codigo="$cder$" AND mensagem="$msgm$" AND servidor="$srvd$" AND codigoAcesso="$cdac$"| fillnull mensagem value="Nenhuma" | table _time, tipo, programa, mensagem, codigo, servidor

[woodcock]

Assuming you are OK with the fact that your form, as it is written right now, will ALWAYS drop EVERY event that does not have a (non-NULL) value for each and every field that you are "filtering" (which I find VERY hard to believe), you can do it like this:

index="raw_internet" tipo="$tipo$" AND programa="$prgr$" AND codigo="$cder$" AND mensagem="$msgm$" AND servidor="$srvd$" AND codigoAcesso="$cdac$"| eval mensagem = if(match(mensagem, "^\s*$"), "Nenhuma", mensagem) | table _time, tipo, programa, mensagem, codigo, servidor

[vitorvmiguel]

Thanks woodcock, i must be misusing something.