Dashboard permits user date input -- why does my search for "isnull" display an error?

[kennethyeung]

I have a dashboard that allows users to choose Date and Month. via drop down box: $t_Date$ and $t_Month$ (e.g 11 September)

I have field is 11_September, 12_September and ...

when I use table $t_Date$$t_Month$, I can display the table correctly.
but if i want to check the field isnull or not
eval tmp=if(isnull($t_Date$$t_Month$),1,0), it will display error
if i put the single or double quotation marks ' , it can display but the result is not what I expect.

[lfedak_splunk]

Hey @kennethyeung, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂

[niketn]

@kennethyeung, if your intent is to set tmp field only if both Date and Month dropdown have values selected, then you can code <change> event handler to default the dropdown values to some exception values ( I have set to 99 for Date and Null for Month). The reason why is it required is that, since you are using these tokens in your search, your search will not run if token/s is/are set to null. Then in the search if I find either 99_ or _Null, I am setting the tmp field to 1. Else to 0. Please find below a run-anywhere example:

<form>
  <label>Combine Tokens as FieldName and Handle Null Values</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="ddDate">
      <label>Select Date</label>
      <choice value="11_">11</choice>
      <choice value="12_">12</choice>
      <change>
        <eval token="t_Date">if(isnull($value$),"99_",$value$)</eval>
      </change>
    </input>
    <input type="dropdown" token="ddMonth">
      <label>Select Month</label>
      <choice value="September">September</choice>
      <choice value="October">October</choice>
      <change>
        <eval token="t_Month">if(isnull($value$),"Null",$value$)</eval>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
          | eval $t_Date$$t_Month$="$t_Date$$t_Month$"
          | eval tmp=if(like('$t_Date$$t_Month$',"%Null") OR like('$t_Date$$t_Month$',"99_%"),1,0)
          | table $t_Date$$t_Month$ tmp
          </query>
        </search>
      </table>
    </panel>
  </row>
</form>

[kennethyeung]

i found that, if use isnull, then it will say error,

Like doesnt have this issue. not sure why

[niketn]

@kennethyeung, if you use tokens in your search and then they can not be null or else search will not execute until the token values are provided ( Search is waiting for input ).

Hence to ensure that search always runs, you need to handle null values upfront. In this run anywhere dashboard I have done that in dropdown input's <change> event handler and replaced with some text as default value.

Later in the search, I have compared with default text rather than null values in the token. Please try out the run anywhere dashboard as it should help you understand and then translate for your use case. If there is any other issue, do give us the details on what code/data you have and what is the error.