How do I make one field mandatory?

[alex_kh]

Hello everybody

I have a dashboard with 4 text inputs (Example: color, shape size, weight)

Splunk takes all these values and performs a search over 9 different indexes.

The problem is that some indexes don't contain all the fields.
for example

Index A has ALL fields
Index B has fields: size, shape and taste
Index C has fields:color, size, sound

that's why when i enter red asterix asterix asterix

i want to have all the events with color=red even if i get something like
red null big 80 indexY
red square small null indexX

by the next search i would define the shape=square as mandatory field
red square small null indexX
null square null null 80 indexZ

Is it somehow possible? maybe with a checkbox?

[493669]

make field value as null whose value is not present like below-

|eval size=if(isnull(size),"NULL",size), shape=if(isnull(shape),"NULL",shape)

[alex_kh]

I suppose you got me wrong.

I have 4 inputs
color=/*
size=/*
shape=/*
weight=/*

If user enters

color= red
size=/*
shape=/*
weight=/*

i want to have results like

red smth smth smth
red smth smth smth
red null null smth

But the color column is ALWAYS filled with red

next search
User enters

color= /*
size=Big
shape=/*
weight=/*

I get a table with
smth big smth smth
smth big smth Null
null big smth smth

[493669]

@alex_kh ,
Suppose when you search with Colour=Red and other field as *, then which events you are receiving and what events you are expecting to come as output?

[alex_kh]

If i run my query with AND
color=$token1$ shape=$token2$ I either get no results or only results from the index which contains all fields

when i do the same stuff with OR
color=$token1$ OR shape=$token2$

I get smth like
red round
red square
yellow round
green triangle

[493669]

writing AND makes it compulsory to have both fields in events and making it OR makes either one of the field is present then also you will get results.
So what is your expected output?