Perhaps using a where clause as well as len to determine if the origin or the recipient should be included or not. But I don't want to follow this path. By using search='index=testindex' the whole index is fetched and this takes a long long time.
Then I thought about this one:
search='index=testindex origin="$originatorKey$" OR recipient="$recipientKey$" | where ((len("$originatorKey$") > 0 AND origin="$originatorKey$") OR len("$originatorKey$")==0) AND ((len("$recipientKey$") > 0 AND recipient="$recipientKey$") OR len("$recipientKey$")==0)'
But it would be better if I could determine beforehand if I need to search for the origin and the recipient or just one of them.
That way, if the user leaves one field empty, you will search for * instead, which seems much easier. Using your example, imagine the user inputs email@example.com as the originator and leaves the recipient empty. The search template would parse to