I am trying to create a dashboard. It has two input text fields. I want to run a search query based on these two inputs. If input A is null AND input B is null then no search results If input A is not null AND input B is null then search using only A If input A is null AND input B is not null then search using only B If input A is null AND input B is not null then search using both A and B Following is my query. It returns no results Properties.application="xyz.api"
| spath Level
| search Level!=Verbose AND Level!=Debug
| eval search_condition_fnum=if(len(trim("$text_fnum$"))=0 OR isnull("$text_fnum$"), "", "RenderedMessage=\"*$text_fnum$*\"")
| eval search_condition_fdate=if(len(trim("$text_fdate$"))=0 OR isnull("$text_fdate$"), "", "RenderedMessage=\"*$text_fdate$*\"")
| eval combined_search_condition=mvjoin(mvfilter(search_condition_fnum!="") + mvfilter(search_condition_fdate!=""), " OR ")
| table search_condition_fnum, search_condition_fdate, combined_search_condition
| search [| makeresults | eval search_condition=mvjoin(mvfilter(search_condition_fnum!="") + mvfilter(search_condition_fdate!=""), " OR ") | fields search_condition]
... View more