Time Picker and Submit on Dashboard

[louispaul76]

Hello Everyone,

I'm trying to create a dashboard for my pair critical devices. I'm not sure what is wrong with my code or if it is the token. When I click on submit, I'm getting the error: Search is waiting for input.
See below my query:

(| inputlookup critical_devices.csv
| eval SplunkHost=lower(SplunkHost)
| join SplunkHost type=outer
[| metadata index=my indexes type=hosts
| rename totalCount as Count, host as SplunkHost, lastTime as "Last Event"
| eval actualhourslag=(now()-'Last Event')/60/60
| eval SplunkHost=lower(SplunkHost)]
| fieldformat "Last Event"=strftime('Last Event', "%c")
| where actualhourslag>HoursLag OR NOT actualhourslag="*"
| stats sum(Count) by SplunkHost
| rename sum(Count) as total

| lookup critical_devices.csv SplunkHost OUTPUT PairGroup
| search PairGroup!=""
| stats count() by PairGroup
| rename count(total) as DevicesPerPairNotResponding)

Any help would be really appreciated.

Best,

Louispaul

[Vijeta]

@louispaul76 where are you using the token , can you write the query or tag where the token is being used.

[tscroggins]

Can you provide more context? The search contains no tokens, and as written, the search will fail with an unbalanced parentheses parsing error.

[louispaul76]

Here is the beginning of the search:

Critical Pair Devices

<input type="time" token="chosentime">
  <label></label>
  <default>
    <earliest>-24h@h</earliest>
    <latest>now</latest>
  </default>
</input>


<panel>
  <title>Pairs by time</title>
  <table>