searching the records of the table with empty field

[Mubarish]

Hi
I have an interactive dashboard with form inputs, i have set default value as * for all the form inputs, depends on the input value/values my search has to execute and matched records of the Table has to display in my panel.If any form input is not given,it can take any value including null/empty. If a particular Field of the table is completely empty, search displays "no record found". what is the default value i have to set so that i can get the records of the table eventhough a particular field is empty.

[somesoni2 · Accepted solution]

The default value you set as "" is correct, but the term * will not match any NULL values. You would have to build appropriate filters within your search to ensure that if "" is selected in form input (or no selection of input value with default as "*"), it matches NULL/Empty field values as well.

Something like this

Your base search ... | eval field1=coalesce(field1,"NA") | search field1=$inputForField1$ 

[cbirajdar]

@somesoni2 how do we do this, if we have like multiple inputs which are likely to have NULL values. I tried my hand with fillnull, it works but the search results come back too slow and delayed. 

[lguinn2]

There is no default value that you can set - you will have to take this into account in the search string itself.

[Mubarish]

I referred the below link for assigning default value as "" for my form inputs.http://docs.splunk.com/Documentation/Splunk/6.1.1/Viz/Buildandeditforms
We assumed that "" takes any non-zero value and execute the search wheras we get "No results found" if any of the field in the log has empty value.Can you please clarify what does "*" means here