Dashboard studio: How to create search for value that may be null - efficiently?

[Andy-AVA]

Hello!

I'm using a text input box to input a username. If I were to simply put that username into my base search, it works great and is very quick. I have other search input parameters, so my problem is that if I DON'T specify a username, I want it to include all values. This includes null values. I started by using an asterisk as the default input value, but that doesn't include null values. The only way I've been able to make this partially work is by removing the username from the base search, then using an eval command to give the null entries a value, and then search the base results for either "*" to include everything, or the username I typed in. This is horribly inefficient because I have to search my entire database for every entry before I can filter it. I also think this doesn't work properly because it has a limit on the number of results in the base search. 

I've done a lot of searching for doing an eval command BEFORE the base search, but that doesn't seem to be possible. This can't be a unique scenario. How do I search for both "null" and "NOT null" values in the base search without removing my username input box?

[ITWhisperer · Accepted solution]

Set the default of your text input to "*" and extend your initial search like this

index=<your index and other filters> 
    [| makeresults
    | fields - _time
    | eval username="$your_text_search$"
    | where username!="*"
    | return username]

[Andy-AVA]

Genius! Thank you! I spent WAY too much time trying to find out how to do that. I skipped the "fields - _time" section. I'm not sure what that's for? It seems to work well without it.

[ITWhisperer]

Yes, you don't need that - it is just a habit I have when using makeresults as it is the only field that is automatically added by makeresults.