dynamic filter in WHERE statement

[alessj]

Hello,

I would like to use a dynamic filter. I have a dropdown($pool$) which select only one value from a list. I want to add a static value "all" that take all the values in the list.

Code working at this moment :
index source
| lookup bundle_3dexp.csv bundleid OUTPUTNEW bundleCode
| eval poolname=bundleCode+poolLetter
| where (poolname="$pool$" AND date >= "$time$")
| dedup login
| table login

How should i modify the code ? Adding an IF statement with the WHERE ?

Thanks you

[wmyersas · Accepted solution]

First, as @skoelpin suggested, change from where to search

Second, create a static drop-down option named "All" with a value of "*"

Then when the | search poolname="$pool$" date>="$time$" runs, if you've selected "All" for the $pool$ dropdown, it will fill-in | search poolname="*" date>="$time$"

[alessj]

i wasn't aware of search function

[wmyersas]

Now you are =D

[skoelpin]

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

Your token is rendered a value before getting passed to that search filter so you are comparing a field to a value.

[wmyersas]

where is used to compare fields and search is used to compare a field to a value. You can only evaluate one function with the where. You can do multiple with a search

That's not true. You can use multiple conditions in a where clause. You can do | where like(field,"%value%") AND field2<$token$ AND match(field3,"<regex>")...

[skoelpin]

Have you tried changing where to search?