https://community.splunk.com/t5/Getting-Data-In/Error-while-searching-using-the-value-from-the-input/m-p/397733#M70918 <P>I have the following dynamic options for my "consumer" multiselect:</P> <PRE><CODE>index=$index$ | fillnull value="not specified" "header" | dedup "header" | table "header" | rename "header" as "consumer" </CODE></PRE> <P>And something like this for my chart where I'm trying to filter the data by the value from multiselect:</P> <PRE><CODE>index=$index$ | fillnull value="not specified" "header" | stats count by "header" | search "header"=$consumer$ </CODE></PRE> <P>The problem is when I'm trying to show data only for "not specified" consumers - it can't find anything.<BR /> The query is working if I change $consumer$ to "not specified", so the problem is in $consumer$.<BR /> Any advices?</P> Wed, 03 Apr 2019 14:17:37 GMT quintessence 2019-04-03T14:17:37Z https://community.splunk.com/t5/Getting-Data-In/Error-while-searching-using-the-value-from-the-input/m-p/397733#M70918 <P>I have the following dynamic options for my "consumer" multiselect:</P> <PRE><CODE>index=$index$ | fillnull value="not specified" "header" | dedup "header" | table "header" | rename "header" as "consumer" </CODE></PRE> <P>And something like this for my chart where I'm trying to filter the data by the value from multiselect:</P> <PRE><CODE>index=$index$ | fillnull value="not specified" "header" | stats count by "header" | search "header"=$consumer$ </CODE></PRE> <P>The problem is when I'm trying to show data only for "not specified" consumers - it can't find anything.<BR /> The query is working if I change $consumer$ to "not specified", so the problem is in $consumer$.<BR /> Any advices?</P> Wed, 03 Apr 2019 14:17:37 GMT https://community.splunk.com/t5/Getting-Data-In/Error-while-searching-using-the-value-from-the-input/m-p/397733#M70918 quintessence 2019-04-03T14:17:37Z https://community.splunk.com/t5/Getting-Data-In/Error-while-searching-using-the-value-from-the-input/m-p/397734#M70919 <P>Try to add the filter before the stats and add quotes around the token (as it has spaces in the value)</P> <PRE><CODE>index=$index$ | fillnull value="not specified" "header" | search "header"="$consumer$" | stats count by "header" </CODE></PRE> <P>If it doesn't work, please share your multiselect xml.</P> Wed, 03 Apr 2019 17:41:07 GMT https://community.splunk.com/t5/Getting-Data-In/Error-while-searching-using-the-value-from-the-input/m-p/397734#M70919 somesoni2 2019-04-03T17:41:07Z