Incorrect (extra) information in Bar Visalization in Dashboard

[DigitalOverdriv]

Hello! I have a dashboard with several visualization panels. One of these is linked to a search that pulls the Top 10 Source IPs by Log Activity.

index="index_name" $token.source.address$
|fields source_address 
|stats count by source_address 
|table source_address, count
|rename source_address as "Source IP", count as "Count"
|sort -Count
| head 10

The token, $token.source.address$, is set by a text box on the dashboard for the bar visualization below. However, in addition to the correct value being shown, there are often other incorrect values shown as well.

There doesn't seem to be a pattern as to why this happens? Does anyone know why this may happen and how to correct it?

Thanks!

[ITWhisperer · Accepted solution]

source_address=$token.source.address$

 It could be that the events that are being returned are where the $token.source.address$ value exists elsewhere in the event.

[DigitalOverdriv]

Thank you! This pointed me in the right direction! It turned out that the issue was that the token was somehow picking up the nat_source_address field as well.