I have a dashboard with 3 dropdowns, let's call call them country, state and city, each with its corresponding token ($country$, $state$ and $city$). They are not inter-dependent, and the default, static value for each dropdown is "*". My data looks like this: timestamp country state city 2019-03-29 USA 2019-03-29 NY 2019-03-29 NYC In other words, each entry can have a value for, at most, 1 of these columns—either country, state or city. For example, country and state can't both have data in any given entry. Nor can state and city, country and city, etc. My (naive) query was something like this: index=* sourcetype=xxx result=000 AND country = $country$ AND state = $state$ AND city =$city$ The problem is, If no value is selected from any dropdown (so the default value "*" is used), no data is being displayed. Why? From what I gather, null values (state and city in the 1st line, country and city in the 2nd line, etc.) are not included in "*". In other words, "country = $country$" would return data on its own for line 1, but since the search also has "state = $state$ AND city =$city$", and those columns are null, no data is shown. Is there a way to exclude the tokens from the query, if no value has been selected? In other words, if the non-default value for country is selected, the query would be index=* sourcetype=xxx result=000 AND country = $country$ and if the non-default value for state were selected, the query would be index=* sourcetype=xxx result=000 AND state = $state$ and if the non-default value for city were selected, the query would be index=* sourcetype=xxx result=000 AND city =$city$ I was also considering using if/then/else or a case statement somehow ... but I can't seem to get it work work. Any help much appreciated, I'm a Splunk noob. ... View more