In general terms, I've been trying to create a search that can perform a subsearch using a few fields that are present in one collection of related events in order to find a unique uuid field, that I then use to perform another search in order to retrieve all events with that uuid, which would include the events found by the prior subsearch, but also other events that do not have the fields used in the original subsearch, but do have this unique uuid (they're sourced from a different application but the uuid is passed through)
The issue I'm having is that the uuid is a relatively new addition, and I'd like to be able to default to essentially the original subsearch (without then filtering on the uuid field) and so at least be able to display some of the events should the user wish to view the logs of a task where they've not used the latest version of the application which contains the uuid update.
My current implementation will return no events at all in targeting old versions of the task as the first subsearch returns the value of the uuid field which in those older events would be null/empty , and I can't seem to find a way to do some kind of conditional where if that subsearch returns null/empty then just re-run the subsearch but don't return the uuid, instead return whatever that subsearch comes back with (or just the result of another search that could be a copy of the original subsearch minus the filtering)
Example:
I've tried using things like where, appendPipe, if, isNotNull etc but with no success so far, though that may be more to do with my lack of understanding than with them not being the rights tool for the job!
Many thanks for any help you can give!