Where's Where's Wildcarding?

[code_monkey]

| where $click.name$ == if("$click.value$" == "Totals", * , "$click.value$")  

This bit of code is intended to allow us to use a drill-down on a table that includes a generated row where the clicked value or the clicked value's field name may not be descriptive search terms, specifically a row of column totals. Obviously, it doesn't work.

1. Where appears to lack the wildcarding semantic entirely, which makes sense I suppose. However, I rather need that bit of functionality.
   
2. A bare * isn't really a valid return value here, a quoted one becomes a useless string literal, and an escaped one doesn't work either.

I was wondering if anyone had a better approach to this kind of last-minute substitution-chicanery, or if anyone knows how to get a match-any boolean expression out of a where clause?

[ziegfried · Accepted solution]

As far as I've understood your intention, you could probably do it this way:

... | where if("$click.value$" == "Totals", true(), $click.name$ == "$click.value$")

Edit:

Here's how you could use the eval command to create conditions for a search:

<some search conditions> [ | stats count | eval search=if("$click.value$" == "Totals", "*", "$click.name$=\"$click.value$\"") | fields search ]

The subsearch (within the square brackets) will expand to an additional search condition for the outer search. (The stats count part is just used to great a single result, thats rather hack/workaround)

[ziegfried]

I've added an example on how you could use the eval command to create conditions for a search query.

[ziegfried]

The where command doesn't "return" anything. It will simply remove those results where the expression evaluates to false. You can use the eval command to create new fields.

[code_monkey]

That does solve it, since where just wants a boolean. I'm still curious about how I'd return something like a wildcard or other non-string value.