Form/Dashboard token for search

[willsy]

Hello, i have what i believe is a basic search and what should work however it doesnt seem to display anything when i search for it.

Effectively what i want it to do is, when you type in X number that will pass into the search as X_token and then search for the number you have just input. could i have some guidance on this please.

Covid_19

<input type="text" token="X_token" searchWhenChanged="false">
  <label>Enter X number for individual information</label>
</input>


<panel>
  <table>
    <search>
      <query>index=* $X_token$  | table "X number" "First Name" Surname "Mobile Number"  Cell Role</query>
      <earliest>-7d@h</earliest>
      <latest>now</latest>
    </search>
    <option name="drilldown">none</option>
    <option name="refresh.display">progressbar</option>
  </table>
</panel>

[richgalloway]

Have you tested the query in the Search & Reporting app by replacing X_token with a number?
BTW, index=* is poor form.

[willsy]

hello, i have yes, the main reason for the index=* is for obfuscation whilst i asked the question, hence X_number and X_token again. I believe i have found out what is causing it, although i do not know the fix for it.

If i complete the search in "fast mode" i get no results, which is by deafult what dashbaords are set up for. so i believe i have to set the dashbaord up to search in verbose mode. OR ammend the search query

[richgalloway]

Fast mode means fields are not extracted automatically at search time so you'll only see index-time fields and those explicitly extracted by the search.