https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-getting-a-quot-Search-is-waiting-for-input-quot-message/m-p/650797#M53344 <P>The token parsing is purely syntactic not semantic i.e. is does not take account of the context in which it finds the $. As you have already discovered, the work around is to double up on the $</P> Mon, 17 Jul 2023 10:27:12 GMT ITWhisperer 2023-07-17T10:27:12Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-getting-a-quot-Search-is-waiting-for-input-quot-message/m-p/650794#M53342 <P>It looks like the token name parser of Splunk contains a bug, otherwise why would it expect to find a token in this eval expression which I simplified for better clarity:</P><PRE>eval x=if(match(url,"test$"),if(match(url,"onemoretest$"),"",""),"","")</PRE><P>&nbsp;I know that if I change it to double $$ it will work OK:</P><PRE>eval x=if(match(url,"test<STRONG>$</STRONG>$"),if(match(url,"onemoretest$"),"",""),"","")</PRE><P>Because of this alleged bug, my dashboard doesn't work properly. It seems that the token parser doesn't recognize any stop characters (like ",<STRONG>)</STRONG> and even <EM>space</EM> etc.) outside the allowed range of characters for token naming. Any help would be greatly appreciated!</P> Mon, 17 Jul 2023 10:09:33 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-getting-a-quot-Search-is-waiting-for-input-quot-message/m-p/650794#M53342 Ilya_Demin_1 2023-07-17T10:09:33Z https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-getting-a-quot-Search-is-waiting-for-input-quot-message/m-p/650797#M53344 <P>The token parsing is purely syntactic not semantic i.e. is does not take account of the context in which it finds the $. As you have already discovered, the work around is to double up on the $</P> Mon, 17 Jul 2023 10:27:12 GMT https://community.splunk.com/t5/Dashboards-Visualizations/Why-am-I-getting-a-quot-Search-is-waiting-for-input-quot-message/m-p/650797#M53344 ITWhisperer 2023-07-17T10:27:12Z