| where $click.name$ == if("$click.value$" == "Totals", * , "$click.value$")
This bit of code is intended to allow us to use a drill-down on a table that includes a generated row where the clicked value or the clicked value's field name may not be descriptive search terms, specifically a row of column totals. Obviously, it doesn't work.
I was wondering if anyone had a better approach to this kind of last-minute substitution-chicanery, or if anyone knows how to get a match-any boolean expression out of a where clause?
As far as I've understood your intention, you could probably do it this way:
... | where if("$click.value$" == "Totals", true(), $click.name$ == "$click.value$")
Here's how you could use the eval command to create conditions for a search:
<some search conditions> [ | stats count | eval search=if("$click.value$" == "Totals", "*", "$click.name$=\"$click.value$\"") | fields search ]
The subsearch (within the square brackets) will expand to an additional search condition for the outer search. (The stats count part is just used to great a single result, thats rather hack/workaround)
That does solve it, since where just wants a boolean. I'm still curious about how I'd return something like a wildcard or other non-string value.
where command doesn't "return" anything. It will simply remove those results where the expression evaluates to false. You can use the
eval command to create new fields.