How to handle non existing fields in multi select

[shikhanshu]

Hi, I have a dashboard with an input element which is a multi-select with a populating search which gets values for the token. The value prefix is

fieldname=" 

and value suffix is

"

I also have a default value of * (with label as All)

So when the user selects All, the token value becomes

fieldname="*"

That's a problem. What I really want to mean by All is, get all records with or without "fieldname". The above value filters out the records in which fieldname is null and I don't want that.

How can I tweak this so that:
1. When user chooses All, the token gets empty string as a value (how is it possible since I have a prefix and suffix)
2. OR, when user chooses All, the token gets value as fieldname="*" OR fieldname="" . That will take care of both null and not null situations.

[shikhanshu]

This does work. Although I don't have access to props.conf (IT maintained Splunk instance), I am able to use eval command in my search and get this going. Thanks!

Can you make this comment as an answer?

[somesoni2]

You can add calculated fields from Splunk UI as well. Go to Settings->Fields -> Calculated fields .

[somesoni2 · Accepted solution]

My Suggestion would be add a "Calculated field" for the fieldname used by multiselect. something like this

props.conf

EVAL-fieldname = coalesce(fieldname,"")

This way your fieldname will either have valid value or will have blanks "" and in both cases fieldname="*" will pick that up.