How to exclude condition from search depending on variable?

[yurykiselev]

Hi!

On my dashboard there is the dropdown list. I want to exlude its token criteria from search query if default value "notdef" is selected. i.e.:

if("$dropdown_token$" == "notdef")
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$
else
    | WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND dropdown_param = $dropdown_token$

I tried to use match replaceing "notdef" by empty sting while "notdef" is selected:

| eval dropdown_req = if("$dropdown_token$" == "notdef", "", "$dropdown_token$")
| WHERE param1 = $param1_token$ AND param2 = $param2_token$ AND match(dropdown_param, dropdown_req)

, but values of $dropdown_token$ include the sign "*" (e.g. "*A") and it doesn't work in regex in match().

Thank you!

[yurykiselev]

I solved this using token prefix-postfix:

  <prefix>| where dropdown_param = "</prefix>
  <suffix>"</suffix>

and blank as default value.

Thank you all!

[niketn · Accepted solution]

You can create the where filter directly from change event of the dropdown using eval. I have given an example based on the details provided. Dropdown choice values might change as per your use case (I expected one of the choice values is notdef).

<input type="dropdown" token="dropdown_token" searchWhenChanged="true">
  <label>Select Field</label>
  <choice value="notdef">Not Defined</choice>
  <choice value="*">All</choice>
  <change>
    <eval token="filterQuery">if($value$=="notdef"," | WHERE param1=$param1_token$ AND param2=$param2_token$", " | WHERE param1=$param1_token$ AND param2=$param2_token$ AND dropdown_param = $value$")</eval>
  </change>
</input>

[dineshraj9]

Can you try this way -

| eval flag=if(like("$dropdown_token$","notdef"),"*","$dropdown_token$") | search param1=$param1_token$ AND param2=$param2_token$ | where dropdown_param=flag