Manipulate URL Parameter as Dashboard Token

[zchef2k]

Hello Everyone. This is my first post in the forum, please be gentle. 🙂

I've spent an inordinate amount of trying to get this to work, but I have a requirement to take a FQDN passed as a URL parameter to a dashboard and convert it to a short hostname for use a token in search for several panels. I have tried just about every combination of <init>, <eval>, and <set> to no avail to get it populate at page load. I have even tried to attack this in search itself, unsuccessfully, by using something similar to this:

index="syslog_main" source="/var/log/messages" | eval short_name=replace(fqdn,"^([^\.]+).+","\1") | where like (host, "%short_name%") ]

Can someone suggest  a new strategy? At this point I'm probably just making it too complicated.

TIA

[richgalloway]

Have you tried rex?

index="syslog_main" source="/var/log/messages" 
| rex field=fqdn "(?<short_name>[^\.]+)"
| where like (host, "%short_name%")