How do I retain table fields in Splunk after a chart pipe? Tried concatenating the values into 'over' parameter, but get 'No results found'

Question

I've got a search where basically I want to show the number of user types per workspace per customer, but I can only get Customer Name and the user types into the table.

This is what I have that gives me that:

 | `workspace_submissions((submissions.workspaceGuid=*), (workspaceGuid=*))` 
 | search userGuid=* 
 | eval userPersona=case(workspaceRole="ADMIN", "Builder", cellValueChanges>0 OR modelChanges>0, "Contributor", cellValueChanges=0 AND modelChanges=0, "Viewer") 
 | lookup user-dc5prod userGuid output active 
 | eval US=if(active=1, "Enabled", "Disabled") 
 | stats count by userPersona workspaceGuid 
 | lookup workspace-dc5prod workspaceGuid output workspaceGuid, currentCustomerGuid as customerGuid 
 | lookup customer-dc5prod customerGuid output type name as customerName sfdcAccountGuid
 | chart values(count) over customerName by userPersona

And I checked out the response at this splunk forum question : https://answers.splunk.com/answers/390709/how-do-i-add-extra-fields-to-a-chart-count-over-fi.html?utm_source=typeahead&utm_medium=newquestion&utm_campaign=no_votes_sort_relev but when I put

 | eval customerName=customerName."#".workspaceGuid."#".sfdcAccountGuid

before chart, I return no results. I need to table customerName sfdcAccountGuid workspaceGuid Builder Contributor and Viewer

Answer 1

I figured it out. My eval statement that included sfdcAccountGuid had null values and since I didn't fillnull, those values were left out entirely. Adding a | fillnull value=NULL sfdcAccountGuid allowed it to pull through correctly.