I have a dashboard which provides a handful of filter criteria, for example, `fieldA=A` and `fieldB=B`.
One such criteria changes the application I am searching on, which does not have `fieldA`. Is there a way to conditionally set my filters such that they only apply to my search query only if `fieldA` exists in an application's logs?
You can probably do this using a where clause after the search, as it's not possible to know in advance of seeing the data, if the field exists in the data.
| where (isnull(fieldA) OR match(fieldA,$fieldAFilterToken$))
Alternatively, you can set up the dashboard inputs for the filters to load their own filter options from a lookup, where the lookup key is the selected application. When you change that application, the token for that application will get a new value, so the inputs with the filter options will then rerun the populating searches to get the filter options from the lookup for each input.
e.g. filter_options.csv
app,filterA,filterB
app1,A,B
app2,,B
app3,A,
app4,,
so your search that populates the filter A selection would do something like
| inputlookup filter_options.csv where app=$selected_app_token|s$
| fields filterA
and the same for B etc.
Hopefully this gives you something to play with.