https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527765#M148997 <P>Doesn't this just do ($test1$ AND $test2$)?</P> Tue, 03 Nov 2020 15:43:41 GMT ITWhisperer 2020-11-03T15:43:41Z https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527320#M148860 <P>How to ignore a field from search if the value is null, search based on the second input.?<BR />I have two inputs and this search will work only if i have some value in both the fields. I need the result, even if one value is null.</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="1.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/11598iC56B7C034591597E/image-size/medium?v=v2&amp;px=400" role="button" title="1.png" alt="1.png" /></span></P><P> </P><P>name="$field4$" OR EmpID="$field5$"</P><P>Found a similar one here,<BR />but this did not resolve my issue.</P><P>Appreciate the help in advance.</P><P><A href="https://community.splunk.com/t5/Getting-Data-In/How-to-omit-a-field-from-search-on-a-text-input-if-the-field-is/m-p/330788" target="_blank" rel="noopener">https://community.splunk.com/t5/Getting-Data-In/How-to-omit-a-field-from-search-on-a-text-input-if-the-field-is/m-p/330788</A></P> Fri, 30 Oct 2020 15:31:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527320#M148860 kuriakose 2020-10-30T15:31:08Z https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527327#M148862 <P>Have your inputs set a new token which includes the name= if the value of the input is not empty otherwise set it to an empty string or perhaps unset it. Then use the whole of the new token(s) in your search.</P> Fri, 30 Oct 2020 15:51:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527327#M148862 ITWhisperer 2020-10-30T15:51:58Z https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527329#M148863 <P>I have field values, name and&nbsp;<SPAN>EmpID in my index. The above search will not work if I am giving only a single input. I have to give both the inputs then only its working. which I don't want. Sometime I will have only one input.</SPAN></P> Fri, 30 Oct 2020 16:07:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527329#M148863 kuriakose 2020-10-30T16:07:21Z https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527342#M148865 <P>Try setting the default to * and/or in the change handler for the text input set a token to * if the input is empty and use those tokens in your search</P> Fri, 30 Oct 2020 16:47:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527342#M148865 ITWhisperer 2020-10-30T16:47:27Z https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527763#M148995 <P>I could sort out this issue by trying |search ($test1$ $test2$).&nbsp;</P><P>Now the search is giving the results even if one input is null.&nbsp;</P> Tue, 03 Nov 2020 15:35:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527763#M148995 kuriakose 2020-11-03T15:35:58Z https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527765#M148997 <P>Doesn't this just do ($test1$ AND $test2$)?</P> Tue, 03 Nov 2020 15:43:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-ignore-a-field-from-search-if-the-value-is-null-and-then/m-p/527765#M148997 ITWhisperer 2020-11-03T15:43:41Z