It sounds like you're asking that all fields present be equal to the same value (for my search that value will be
rightvalue). If that is the case, you can use
foreach to check the value of each field, and use some additional logic to accomplish what you are looking for. This run anywhere example shows this in action:
| makeresults | eval fieldA="wrongvalue", fieldB="rightvalue", fieldC="rightvalue", fieldD="wrongvalue" | append [| makeresults | eval fieldA="rightvalue", fieldB="rightvalue", fieldC="rightvalue", fieldD="rightvalue"] | fields - _time | foreach * [eval validity=if((isnull(validity) or validity="valid") and <<FIELD>>="rightvalue", "valid", "invalid")]
If you need the new field to be null instead of "invalid", you could add
| eval validity=if(validity="valid", validity, NULL)
Yes, thanks, and corrected above. I changed my field names after pasting the search into answers, and I missed that one. Annoyingly the incorrect search actually gave the correct results for those specific test cases.
Basically you can use
Foreach command for search. Your search like below..
YOUR_SEARCH | eval valid="true" | foreach "*" [ eval valid=if('<<FIELD>>'=="x","true","false") ]
I hope this will help you.