Dashboards & Visualizations

In Simple XML, have * as default text input value is causing incorrect results.

lyndac
Contributor

I am using splunk 6.3.1. My data is indexed as JSON. Not all fields will have a value. For example, 2 (very simplified events) could look like this:

{
  "host":"hostname",
  "field2":"pickle",
  "field3":  "onion"
}
{
  "host": "host2",
  "field2": "pickachu"
}

I have a dashboard form (simple xml) that allows the user to use text fields to filter their results. Currently I have the default value for each of the text fields set to an asterick . If the user only enters a value for host, and field 2, the token for field3 gets set to *

index=foo host="hostofmine" field2="pic*" field3="*" | stats count by host

Since field 3 is an optional field (it may or may not be in the raw json document), having a default value of * causes my search to return incomplete results. For the simple data above, only 1 event will be returned, but I would like both events to return. I tried just removing the default value, but the search doesn't execute unless I type something into the text field.

How can I make it so that the user does not have to enter a value into all 3 text fields and only the fields where the user does enter a value are part of the search?

0 Karma
1 Solution

frobinson_splun
Splunk Employee
Splunk Employee

Hi @lyndac,
Take a look at this previous Answers post:
https://answers.splunk.com/answers/4911/evaluating-form-field-if-not-null.html

It discusses using a prefix and suffix around the field to handle cases where users do not input a value. See also this documentation, which includes details for prefix and suffix:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/PanelreferenceforSimplifiedXML#form
Hope this helps!

View solution in original post

0 Karma

frobinson_splun
Splunk Employee
Splunk Employee

Hi @lyndac,
Take a look at this previous Answers post:
https://answers.splunk.com/answers/4911/evaluating-form-field-if-not-null.html

It discusses using a prefix and suffix around the field to handle cases where users do not input a value. See also this documentation, which includes details for prefix and suffix:
http://docs.splunk.com/Documentation/Splunk/6.3.3/Viz/PanelreferenceforSimplifiedXML#form
Hope this helps!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...