Conditionally search if search field exists

[cclva]

I have a dashboard which provides a handful of filter criteria, for example, `fieldA=A` and `fieldB=B`.

One such criteria changes the application I am searching on, which does not have `fieldA`.  Is there a way to conditionally set my filters such that they only apply to my search query only if `fieldA` exists in an application's logs?

[bowesmana]

You can probably do this using a where clause after the search, as it's not possible to know in advance of seeing the data, if the field exists in the data.

| where (isnull(fieldA) OR match(fieldA,$fieldAFilterToken$)) 

Alternatively, you can set up the dashboard inputs for the filters to load their own filter options from a lookup, where the lookup key is the selected application. When you change that application, the token for that application will get a new value, so the inputs with the filter options will then rerun the populating searches to get the filter options from the lookup for each input.

e.g. filter_options.csv

app,filterA,filterB
app1,A,B
app2,,B
app3,A,
app4,,

so your search that populates the filter A selection would do something like

| inputlookup filter_options.csv where app=$selected_app_token|s$
| fields filterA

and the same for B etc.

Hopefully this gives you something to play with.