Hi all,
So here's a question. I'm taking over a Splunk app from a previous developer, and they're using a whole bunch of pulldowns to display some data, and the setup appears to be working something like this (hoping the xml shows up correctly too):
...
FieldA_Select
FieldA :
|stats count by fielda
fielda
10
fielda="$value$"
+OR+
( $value$ )
left
FieldB_Select
FieldB :
|search $FieldA_Select$ |stats count by fieldb
fieldb
10
fieldb="$value$"
+OR+
( $value$ )
left
And this is all fine. But I want to add a new field for some new data that's getting added. But the old data doesn't exist for the majority of the records, so I need to set a default value. Did some searching and found out about fillnull, so I set up a new field (C) like this:
FieldC_Select
FieldC :
|fillnull value="None" fieldc|stats count by fieldc
fieldc
10
fieldc="$value$"
+OR+
( $value$ )
left
FieldA_Select
FieldA :
|search $FieldC_Select$|stats count by fielda
fielda
10
fielda="$value$"
+OR+
( $value$ )
left
FieldB_Select
FieldB :
|search $FieldC_Select$ $FieldA_Select$ |stats count by fieldb
fieldb
10
fieldb="$value$"
+OR+
( $value$ )
left
....
But this doesn't work, i.e. the other pulldowns come up with (no value found). I'm guessing that I need to change the postProcess on the FieldA and FieldB searches, but I'm not entirely sure how. I tried putting a fillnull on some of the later searches, but it doesn't seem to help. So, any suggestions would be great, thanks!
------ Cordis
... View more