Dashboard to query optional fields

[gtonti]

My log file is:

1. TimeStamp=20180521095103123 Service=ABC12 User=ut1234 Id=12345678 Msg=ttttttttttttt
2. TimeStamp=20180521095103456 Service=ABC12 Id=12345678 Msg=xxxxxxxxxxxx
3. TimeStamp=20180521095103723 Service=ABC12 User=ut1234 Msg=yyyyyyyyyyyyyyyy

I want a dashboard in which I can search for Service, User, Id.
I made three input fields with default="*".

2. 
   
3. Service
4. *
5. 
   
6. 
   
7. User
8. *
9. 
   
10. 
    
11. id
12. *
13. 
    

My query is:

1. index=xxxx Service=$serviceToken$ User=$userToken$ Id=$idToken$

When I make the query I get only thee first row of the log.
I understood that it is related to fields not present in the log file.

How can I modify my dashboard/query to obtain alle the rows?

Thank you

[gtonti]

Hi everybody,
I adopted this solution. I created a token using change/condition. In this scenario I changed the default value form "*" to blanck.

The input in the xml dashboard definition is:

1. <input type="text">
2. <label>User</label>
3. <initialValue></initialValue>
4. <change>
5. <condition value="">
6. <set token="userToken"></set>
7. </condition>
8. <condition>
9. <set token="userToken">User=$value$</set>
10. </condition>
11. </change>
12. </input>

the query is:
index=xxx $userToken$

what happens is:
1) if User is empty/blank the query is index=xxx
2) if User has a value the query is index=xxx User=value

[duartet]

Worked for me! Thanks

[mayurr98]

Try this

index=xxxx Service=$serviceToken$ Id=$idToken$ OR User=$userToken$ 

let me know if this helps!

[gtonti]

Thank you for the reply.
It works if I leave * in all the inputs.
If I set User to ut1234 I want only two lines as response of the query (the row 1 and 3).

Thank you

[mayurr98]

Yes, you are right this will not work in that case. This is because you are searching User=ut1234 OR Id=*
In order to write correct search query, you would need to add only those fields which are available in all the events. OR else you would need to find a workaround

Try this

index=xxxx | fillnull value="NA" User |search  Service=$serviceToken$ Id=$idToken$  User=$userToken$