Splunk Search Query Help

[newBie001]

Hello All,

Could you please suggest to me whether this option is good or is there any optimized search query?

 query ---
index="XXX1" source="XXXX11" jsonbodyfield1=abc | search "jsonbodyfield2"=XXXX1 AND "jsonbodyfield3"=XXXX2 AND "jsonbodyfield3"="XXXX" AND jsonbodyfield4="XXX2" | stats count as Total

The user will have drop down option to select "jsonbodyfield1" and "jsonbodyfield4" from the available values.

Now this one field "jsonbodyfield4" is added new to the logs structure and since this is in AND condition so now the query shows the total count of records where this field is present (irrespective of its value). 

However, whenever the default value (*) of "jsonbodyfield4" is chosen from the dropdown then i want to show all records where the field is present (in the new logs) and the field was not present (in the old logs).

I was thinking to use multi-search query and having the where condition as (NOT jsonbodyfield4="*").
This might not work or may be not a good approach so could anyone please suggest?

Thanks.

[ITWhisperer]

The values in the dropdown for jsonbodyfield4 could include the full clause e.g. AND jsonbodyfield4="XXX2" and when the label is * you set the value to an empty string, then you include the token in the search string e.g. ... AND "jsonbodyfield3"="$dropdowntoken3$" $dropdowntoken4$ | stats count as Total