How to achieve dynamic dropdown all option?

[Aroot002]

So I've searched and searched but can't seem to find an answer to my issue. I need to add an all option to my dynamic dropdown. I have found answers that seem like they should be simple enough. Either add All, * to static or alter the XML code. I've tried both, (I think when I altered the XML code it pretty much caused the dropdown to be the exact same way as it was had I just added the options to the static section) and each time I am getting a "search string cannot be empty" error. Don't know if it matters but I did watch a couple youtube videos, their search used | table fieldname | dedup fieldname at the end, when I did that I got the same issue, but now all the field values are grouped together, so I'm doing | stats count by fieldname at the end

[johnhuang · Accepted solution]

This is how I would typically configure it:

[Aroot002]

Same issue, says that it's ignoring search expansion due to error "search string cannot be empty"

[johnhuang]

Could you click on the magnifying glass to "Open in search" and provide the query?

[Aroot002]

I'm actually working on my other computer, but I did click the glass, I got the same error when the search opened, could this be more of a log issue? I actually swapped it out for another field and did not get the error.

[johnhuang]

I think it's more of a query issue - could you provide a sample of the query when open to a new search?

[Aroot002]

I actually just did a simple search to test it out. index=index_name source_type=windows fieldname=* and that got the error. Also tried with quotation marks. But if I change the fieldname to a different one I don't get that error. I don't have a lot of experience in this so I immediately assumed it was something I am doing.

[johnhuang]

Just to confirm,

You ran:

index=index_name source_type=windows fieldname=*

and got an error "search string cannot be empty"? 

[Aroot002]

Yes, the error is "Ignoring fieldname "value1" for search expansion due to error="search string cannot be empty"

"Ignoring fieldname "value2" for search expansion due to error="search string cannot be empty"

[johnhuang]

If possible, could you provide a screenshot.

[Aroot002]

I'm actually accepting your first response as a solution... essentially your answer was the correct one. My problem was being caused by an underlying issue with the logs I am querying.