Search for event field that can 'potentially' contain NULL values

[kenth213]

I have a dashboard that has input field tokens to populate a search string. These input fields default to * when no value is specified.
When the wildcard is used, I am having trouble displaying all events when a field has a NULL value.

For example I have fields "FIELD1" and "FIELD2", and events with the following values:
- A) FIELD1 = Admin FIELD2 = Active
- B) FIELD1 = Admin FIELD2 = Active
- C) FIELD1 = User FIELD2 = Inactive
- D) FIELD1 = User FIELD2 =

Event D FIELD2 is NULL. If my search was FIELD1 = * and FIELD2 = "Active" I only return events A and B (correct). However if my search was looking for FIELD1 = * and FIELD2 = * I only find events A B and C.

How do I return all FIELD2 values even if NULL if no value has been specified in the input field - and still enable a specific value to be used e.g. Active?

[jayannah · Accepted solution]

"NOT FIELD2=*" returns the events where FIELD2 value is NULL.

For your case :

     option-1:  FIELD1=*  AND (FIELD2=* OR  NOT FIELD2=* )
     Option-2:  |fillnull value=SOMETHING FIELD2 | where FIELD1=* and FIELD2=*

option-1 is preferred.

let me know if it doesn't work.

[kenth213]

Option 1 was close, but had issues if a user input other than * is specified. For searches when no user input is specified it works perfectly (as * is default value).

Option 2 was easiest for me to use as I just assigned FIELD2 = "" and could then leave my search string logic as it was.

Thanks for the help.