Editing search query if token not null - Splunk - splunk

Question

I'am trying to add information to my search query in splunk if a token is not null but is not working.
I have an input checkbox called filtre, and I want to modify my search if the input filtre is used.
so, I want to do this
if $filtre$ == null
index="fortigate" policyid=$policy$ $scr_dest$=$IP$ service=$service$ NOT action = blocked
| stats values(src_ip) values(dest_ip) values(service) values(action)
else:
index="fortigate" policyid=$policy$ $scr_dest$=$IP$ service=$service$ NOT action = blocked
| stats values(src_ip) values(dest_ip) values(service) values(action) by $filtre$
I have been trying by * by null , using eval and multisearch
| multisearch
[search index="fortigate" policyid=$policy$ $scr_dest$=$IP$ service=$service$ NOT action = blocked
| stats values(src_ip) values(dest_ip) values(service) values(action)
| where like($filtre$ == null ) ]
[search index="fortigate" policyid=$policy$ $scr_dest$=$IP$ service=$service$ NOT action = blocked
| stats values(src_ip) values(dest_ip) values(service) values(action) by $filtre$
| | where like($filtre$ !=null) ]
Nothing works.
Thanks

Answer 1

The command where like($filtre$ == null) is incorrect. The like function compares a field value to a SQL pattern and expects two arguments rather than a single boolean expression. To determine if a field is or isn't null, use the isnull() or isnotnull() function.
Using stats ... by $filtre$ will fail when the token is empty because the field required by by will be absent. To fix that, we have to make by go away when $filtre$ is null, which can be done using a separate token.
When the filtre token is set, define another token (which I'll call $by$) and use that in the stats command. When $filtre$ is cleared, unset $by$.
<input type="checkbox" token="filtre">
...
<change>
<condition match="$filtre$=="Enable"">
<set token="by">by $filtre$</set>
</condition>
<condition>
<set token="by"> </unset>
</condition>
</change>
</input>
| stats ... values(action) $by$