Is there a special token syntax within a "stats count by" in a search string for drop-down menu inputs?

[skender27]

Hi,

I'd like to add some input control in a dashboard I have with this search string:

sourcetype=my_sourcetype  created_date>0  | stats count by field1 $token1$ $token2$

where $token1$ has to capture right values as searching manually custom_field="value1" or custom_field="value2"...

As you see, I need to select (with a drop-down menu) only the values for fields represented by token1 and token2 and so I put the right tokens, but it doesn't work (I get a syntax error).

Is there a special syntax to use tokens within stats count by?

Thanks a lot,
Skender k.

[jeffland · Accepted solution]

There is no special syntax needed, have you tried running the search by hand? I.e. if the input to your token is textA and textB, can you run a search

sourcetype=my_sourcetype created_date>0 | stats count by field1 textA textB

?

Also, you can easily show the content of your tokens for debug reasons by simply adding them to a label or header of some panel, even the input itself - e.g. put this in the label of the input:

value of input is $token1$

and you'll immediately see what token1 contains to check if there's something amiss with that.

[skender27]

Hi Jeffland,

Thanks a lot.
I inspected the result and I got this error (row highlighted in yellow):
stats count by field1 "value of token1" "value of token2"

and the search returned no results.

I resolved it by adding in the search string separately:
... | search field_tokenized1=$token1$ field_tokenized2=$token2$

[skender27]

I forgot to add the following comment:
There are two tokens in the same search string.