Dashboards and search time extraction

[brywilk_umich]

I have a search that works great that I am now building a dashboard for, the problem I am running into is that I am doing a field extraction at the time of search using rex. So when I create the dashboard and have the one token Im entering $ip$ it runs into a issue when it gets to the user field that Im extracting to feed the ldapfilter command. Is there any workaround for this? Or would all the field extraction need to occur beforehand?

src_ip=$ip$ #this is the input text token in the dashboard

(
(index=radius sourcetype=radius src_ip=*) OR   
(index=collaboration) OR 
(index=google) 
) 
| lookup dnslookup clienthost as src_dns OUTPUT clientip as x_src_ip
| eval xx_src_ip=src_ip
| eval src_ip=coalesce(xx_src_ip,x_src_ip)
| iplocation src_ip allfields=true | sort -_time  
**| rex field=user mode=sed "s/@email.edu//g" 
| ldapfilter domain=email.edu search="uid=$user$" attrs="InstRoles"**

[somesoni2]

Since $ is a special character used for tokens in dashboards, you need to escape it by using 2 $ signs. LIke this

(
 (index=radius sourcetype=radius src_ip=$ip$) OR   
 (index=collaboration) OR 
 (index=google) 
 ) 
 | lookup dnslookup clienthost as src_dns OUTPUT clientip as x_src_ip
 | eval xx_src_ip=src_ip
 | eval src_ip=coalesce(xx_src_ip,x_src_ip)
 | iplocation src_ip allfields=true | sort -_time  
 **| rex field=user mode=sed "s/@email.edu//g" 
 | ldapfilter domain=email.edu search="uid=$$user$$" attrs="InstRoles"**