Pulldown cascade with a sometimes missing data value

[cordis]

Hi all,
So here's a question. I'm taking over a Splunk app from a previous developer, and they're using a whole bunch of pulldowns to display some data, and the setup appears to be working something like this (hoping the xml shows up correctly too):

...

And this is all fine. But I want to add a new field for some new data that's getting added. But the old data doesn't exist for the majority of the records, so I need to set a default value. Did some searching and found out about fillnull, so I set up a new field (C) like this:

But this doesn't work, i.e. the other pulldowns come up with (no value found). I'm guessing that I need to change the postProcess on the FieldA and FieldB searches, but I'm not entirely sure how. I tried putting a fillnull on some of the later searches, but it doesn't seem to help. So, any suggestions would be great, thanks!

------ Cordis

[cordis]

Thanks for the reply!

Well no, fieldc, fielda and fieldb don't occur on the same events, that's the point. All the data definitely has fielda and fieldb, but fieldc is new, I just started adding it in. So I have a whole bunch of old data that doesn't have fieldc, but everything has all the other fields.

So in terms of the other postprocess searches, I need to add the fillnull to all of those? I was thinking that the $FieldX_Select$ things held those search results, but I'm not surprised to be wrong. So one thing I've tried that seems to work is this:

<param name="postProcess">|search $FieldC_Select$|stats count by fielda</param>

to

<param name="postProcess">|fillnull value="None" fieldc|stats count by fielda</param>

Now will that work? For records that do have fieldc, I do want it to do a subselect on those records, will this still do that? Thanks again for the help!

[sideview]

My first thought is an obvious thing to check but are you sure that fieldc, fielda and fieldb actually occur on the same events?

To discuss what your code is doing -- In the postProcess that your fieldc Pulldown uses, you're using the fillnull command, although the only effect that fillnull will have there is to add "None" to the values in your fieldc Pulldown.

If the "None" value is then selected in the fieldc Pulldown, it will definitely result in "no values found" in the other Pulldowns, because the postprocess searches in the other Pulldowns lack the fillnull clause, meaning fieldC="None" will return zero results.

And as a general piece of advice - Do not use things like FieldC_Select for the Pulldown that governs the fieldc param. Just give the Pulldown

<param name="name">fieldc</param>

This simple change will make your life a lot easier. There is no reason to call the name params anything different than the actual field names, and in fact calling it the same thing will make certain advanced drilldown features in the Redirector module work better. You'll also be able to use the $name$ shorthand, ie:

<param name="valueField">$name$</param>
<param name="template">$name$="$value$"</param>

which is a simple thing but it can cut down on a lot of copy-and-paste errors.

UPDATE: On second thought, I'm pretty sure that the problem is that the base search, on which you're running these postprocess searches, does not refer to "fieldc" in any way, so Splunk will not be extracting fieldc. Go to the Sideview Utils app and go to the main postprocess documentation page in that app, at "Key Techniques > Using PostProcess > Intro". that page gives the best and clearest explanation of postprocess and the related pitfalls. Honestly when people start using postProcess they pretty much fall into one of the pitfalls described on that page and that's all that's happened here.

[sideview]

I think I figured out your problem - updated my answer. There are some unintuitive things you have to do when you're using postprocess. In short, go get the latest Sideview Utils app and read the docs at "Key Techniques > Using PostProcess > Intro"