I have two TEXT fields Object and modifier. I want to create dashboard based on either of the field. tried with "if condition", it did not work. Javascript is also fine Example: field1=object field2=modifier | index=name event=$object$ action=$modifier$ |table content group -->if both fields are provided no worries -->if both are not provided then both should be "wildcard(star)" -->if field1 is specified and field2 is not specified then field2 should be "wildcard(star)" -->if field2 is specified and field1 is not specified then field1 should be "*" How to achieve this? Thanks. Kranthi M ... View more

@splunkazureteam, kindly check if answer of the following question helps. https://answers.splunk.com/answers/594322/how-to-use-multiple-text-tokens-even-with-no-value.html ... View more