I would recommend you use the rex command : |rex field=WHATEVER "(?<my_new_field>MATCH_TO_CHECK)"
This will simplify your conditional logic becuase you can just do:
eval includeRecord = if((d != "" AND d != null) OR ( a.b AND isnotnull(my_new_field)), "true", "false") | search includeRecord=true
Hope you can understand my untested code 🙂
... View more