Change search based on Token Value

[moonie]

Hi,

I am kind of new to Splunk and have a problem with my search. I have a dashboard where I have an input field for a ID. I search two different inputlookups with this ID and my dashboard is based on this.
But not every table entry has the field for this ID, sometimes the field is not existing. I tried to fix this by searching  id!=*, which works fine when I just enter * for ID Inputfield, but in case I want to put an actual ID I don't want to search for all entries with id!=* (not existing). 
Is there a way to change my search based on the Tokenvalue I enter in the input field? So if I enter * the search looks for id=* & id!=*, but if I enter an actual id the search only looks for id=$id$? 

Any help would be highly appreciated! Thanks

[ITWhisperer]

In the change handler for the input, eval a new token based on (using an if function) whether the input value is * or not and set the value of this token to either "id=*" or "id!=$inputtoken$" and use this new token in your search, that is, the new token includes the field to be matched.