How do I make the dashboard understand that it doesn't need an input for ID3?

[thomasananthan]

Hi all,

I am trying to pass a text box input in a dashboard called token ID1 which works fine but the issue here is that I am using the $ sign again to do a 2nd search from a field extract ID3 from index idx1 with a map search on index idx2 with the field that was extracted ID3.

The issue here I think is that the dashboard is expecting an input for ID3 because I am using the $ sign. As this search works fine when done in splunk search by manually passing ID1. How do I make the dashboard understand that it doesn't need an input for ID3?

index=idx1 $ID1$ | rex field=_raw "(?.*?)<.*?someString"(?.*?)">(?.*?)somemorestring" | dedup ID3 | map search="search (\"string1 with spaces\" OR string2 OR string3 OR \"string 4 with spaces\" OR \"string 5 with spaces\" OR \"string6\") index=idx2 $ID3$"
Hope this makes sense,

Thanks for your help.
Tom

[thomasananthan]

Thanks a lot Elliot! worked like a charm 🙂

[elliotproebstel]

Glad to help! 🙂

[elliotproebstel · Accepted solution]

Have you tried wrapping ID3 with double dollar signs like this: $$ID3$$? According to the docs, that is needed if you are referencing a variable within a map command on a form.
http://docs.splunk.com/Documentation/Splunk/7.1.0/Viz/tokens