Decide between two queries?

[tjsnow]

I need to decide which token to use in a dashboard query (one or the other would be used for my "host" filed in the results) based on the value of one of the tokens. if I don't select a value for $t_pod$ I want the query to use $t_host$ but if I select a value for $t_pod$ I want to use that in the query.

index=MYINDEX subid=$t_submissionID$ msg=$t_messageType$ host=$t_host$

index=MYINDEX subid=$t_submissionID$ msg=$t_messageType$ host=%t_pod$

How can I decide which to use based on $t_pod$?

[jpolvino]

If you have text fields for both t_host and t_pod in your dashboard, this might help. It just shows the substitution.

<form>
  <label>tjsnow</label>
  <fieldset submitButton="true" autoRun="false">
    <input type="text" token="t_pod">
      <label>t_pod</label>
      <default>default_t_pod</default>
      <initialValue>default_t_pod</initialValue>
      <change>
        <set token="t_pod">$value$</set>
      </change>
    </input>
    <input type="text" token="t_host">
      <label>t_host</label>
      <default></default>
      <change>
        <set token="t_host">$value$</set>
      </change>
    </input>
  </fieldset>
  <row>
    <panel>
      <table>
        <search>
          <query>| makeresults
| eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$")</query>
          <earliest>-24h@h</earliest>
          <latest>now</latest>
        </search>
        <option name="count">10</option>
        <option name="drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </table>
    </panel>
  </row>
</form>

In your example, you can then do something like this:

index=MYINDEX subid=$t_submissionID$ msg=$t_messageType$
| eval hostToken=if("$t_host$"=="","$t_pod$","$t_host$")
| where host=hostToken

[asneed_eu]

What is the placeholder value if there's no selection for one of those token? Is it a wildcard?