[BUG] source = * does not work

Query Information

PPL Command/Query:

source = *

Expected Result:
it should be a valid PPL query

Actual Result:

[<EOF>] is not a valid term at this part of the query: 'source = *' <-- HERE. Expecting one of 370 possible tokens. Some examples: 'SEARCH', 'DESCRIBE', 'SHOW', 'EXPLAIN', 'FROM', ...

Dataset Information

Dataset/Schema Type

• OpenTelemetry (OTEL)
• Simple Schema for Observability (SS4O)
• Open Cybersecurity Schema Framework (OCSF)
• Custom (details below)

It doesn't matter i don't think

Index Mapping

does not matter

Sample Data

Does not matter

Bug Description

Issue Summary:

Steps to Reproduce:

1. On OSD, create an index pattern with pattern: "*"
2. try querying with it, it will result in error

Impact:

• we are introducing a concept called "virtual datasets" in OSD, where if the user has not predefined a dataset, we will default to "*", ie selecting all indexes in your data source. We can mitigate the issue by adding backticks, but ideally this should be handled by the grammar.

Environment Information

OpenSearch Version:
all, tested on latest

Start by reproducing the PPL query source = * on the latest OpenSearch version and compare it with the backtick workaround described in the issue. Trace the PPL grammar responsible for parsing the source expression and add a regression test for the wildcard form. Done means source = * is accepted as a valid PPL query.