How to pass multiple values for a field through token in a dashboard?

[Soundaryakunder]

Dashboard is taking a long time to load and it has 17 apps in one panel. I have also tried creating a token such as <set token="app_names">app1,app2</set> instead of using wildcard.  but query is not returning any result.

Code snippet

 <init>
    <set token="app_names">app1,app2,app3................</set>
 </init>
 ......
  <row>
    <panel>
      <title>Dashboard</title>
      <table>
         <search>
          <query>index=idx ns=xyz* app_name=$app_names$ pod_container=xyz* ((" ERROR " OR " WARN ")
		  |stats count by app_name
          | append
    [| stats count
    | eval app_name="app1,app2,app3........"
    | table app_name
    | makemv app_name delim=","
    | mvexpand app_name]
	.......

Please advise!

[ITWhisperer]

Would something like this help?

index=idx ns=xyz* app_name IN ($app_names$) ...

[Soundaryakunder]

Your solution really helped. Thank you very much

[Soundaryakunder]

 I have created a dashboard with 3 panels and it has 17 apps.

Please help me on this.

[ITWhisperer]

It depends on what you are trying to display in your dashboard - if you have 17 searches to do, this will take some time - there are various optimisations available but it depends on your use case - things to consider are summary indexes, saved reports, splitting across multiple dashboards, hiding panels until data is available, etc.

[Soundaryakunder]

Okay. Thanks

[Soundaryakunder]

I need one more help..

I have already specified the multiple values(app1,app2,app3.....)in the token. So I have tried to remove the eval(eval app_name="app1,app2,app3........") command from the Query. but it is returning wrong results. Is this eval command is required?

Please suggest me on this.

 <init>
    <set token="app_names">app1,app2,app3................</set>
 </init>
 ......
  <row>
    <panel>
      <title>Dashboard</title>
      <table>
         <search>
          <query>index=idx ns=xyz* app_name IN ($app_names$) pod_container=xyz* ((" ERROR " OR " WARN ")
		  |stats count by app_name
          | append
    [| stats count
    | eval app_name="app1,app2,app3........"
    | table app_name
    | makemv app_name delim=","
    | mvexpand app_name]
	.......

 Thanks.