Hi
I am trying to build a multi-input textbox dashboard based on a KVstore lookup.
My query is like this
| inputlookup <some-host-detail-kvlookup>
| search $computer_name$ OR $computer_number$ OR $computer_id$
| fields computerName computerNumber ComputerId ...
each token has a prefix i.e. <fieldName> = (which is the column header field in the lookup)
each token also has an initial value = null
thus the query runs like this
| search computerName=null OR computerNumber=null OR ComputerId=null
| search computerName=FOO OR computerNumber=null OR ComputerId=null
as you can see setting the <fieldName> to null allows the search to run without breaking, but after a user enters FOO for the computerName value, they need to reset the blank search inputs back to null. Otherwise if a blank is passed like
| search computerName= OR computerNumber=null OR ComputerId=null
the search breaks.
Any suggestions how to ignore the empty inputs or a way to reset the initial values to null again is greatly appreciated. OR if anyone has a suggestion to do this another way, I would very much like to hear.
Thank you
