| where $click.name$ == if("$click.value$" == "Totals", * , "$click.value$")
This bit of code is intended to allow us to use a drill-down on a table that includes a generated row where the clicked value or the clicked value's field name may not be descriptive search terms, specifically a row of column totals. Obviously, it doesn't work.
I was wondering if anyone had a better approach to this kind of last-minute substitution-chicanery, or if anyone knows how to get a match-any boolean expression out of a where clause?
As far as I've understood your intention, you could probably do it this way:
... | where if("$click.value$" == "Totals", true(), $click.name$ == "$click.value$")
Edit:
Here's how you could use the eval command to create conditions for a search:
<some search conditions> [ | stats count | eval search=if("$click.value$" == "Totals", "*", "$click.name$=\"$click.value$\"") | fields search ]
The subsearch (within the square brackets) will expand to an additional search condition for the outer search. (The stats count part is just used to great a single result, thats rather hack/workaround)
As far as I've understood your intention, you could probably do it this way:
... | where if("$click.value$" == "Totals", true(), $click.name$ == "$click.value$")
Edit:
Here's how you could use the eval command to create conditions for a search:
<some search conditions> [ | stats count | eval search=if("$click.value$" == "Totals", "*", "$click.name$=\"$click.value$\"") | fields search ]
The subsearch (within the square brackets) will expand to an additional search condition for the outer search. (The stats count part is just used to great a single result, thats rather hack/workaround)
I've added an example on how you could use the eval command to create conditions for a search query.
The where
command doesn't "return" anything. It will simply remove those results where the expression evaluates to false. You can use the eval
command to create new fields.
That does solve it, since where just wants a boolean. I'm still curious about how I'd return something like a wildcard or other non-string value.