Splunk Search

How to edit multiselect token to include a field with a null value?

kualo
Explorer

I have a multiselect box on a field-- modelName

modelName can have different values or empty value.
eg. modelName="modelA" modelName="modelB" or modelName=""

modelName="*"

I set the default multiselect token to "*" to select all of the records. But it will ignore modelName=""(the null case)
Is there anyway to include the null case?
Thanks.

0 Karma

to4kawa
Ultra Champion
Search=1337 
| eval UserBuilding=coalesce(UserBuilding, "nothing")
| stats count by UserBuilding
| table UserBuilding

try this, @jregruit

jregruit
Engager

That will work, thank you!

0 Karma

niketn
Legend

@jregruit if your issue is resolved do accept/up vote the answer by @to4kawa.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi kualo,
I generally use

(modelName="*" OR NOT modelName="*")

Bye.
Giuseppe

0 Karma

jregruit
Engager

I'm still a bit confused on this one, can someone please assist? I am trying to populate null values in a multiselect box. My current code is:

    Search=1337 | stats count by UserBuilding  | table UserBuilding

Right now, I am getting all entries with a value as a selection, but not the null values... Not sure what I am doing wrong. Any help is appreciated.

Thanks!

0 Karma

jregruit
Engager

What should my syntax be here?

0 Karma

to4kawa
Ultra Champion

I don't think your query is wrong.
What do you want to populate?
null means nothing

0 Karma

jregruit
Engager

In my multiselect checkbox, I would like to have a option for occurrences of null values.

0 Karma

to4kawa
Ultra Champion

Hi, @jregruit

stats by remove null values.

0 Karma

jrodman
Splunk Employee
Splunk Employee

Search has long lacked a good way to distinguish between a field that is not present vs a field that is present but has an empty-string value for the current record.

What I've generally had to do is (modelName="*" OR modelName="")

This isn't a full answer because it doesn't tell you how to handle this in a view. Sorry I'm not sure.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...