User a token with where and like

[chadman]

I have a search and can use something like | WHERE LIKE(Workstation, "%partofsearchgoeshere%"). I was hopping I could do something like this with a token, but it's not showing any results. I tried this | WHERE LIKE(Workstation, "%$token$%")

[tiagofbmm · Accepted solution]

Please re-check you dashboard script for errors. I just tried it and it works the same way. Check the example below as it is generic and you can copy it for your test environment:

<form>
  <label>tokenwhere</label>
  <fieldset submitButton="false">
    <input type="dropdown" token="src">
      <label>field1</label>
      <fieldForLabel>source</fieldForLabel>
      <fieldForValue>source</fieldForValue>
      <search>
        <query>| tstats count where index=_internal by source</query>
        <earliest>-24h@h</earliest>
        <latest>now</latest>
      </search>
    </input>
  </fieldset>
  <row>
    <panel>
      <chart>
        <search>
          <query>index=_internal | where LIKE(source,"%$src$%") | timechart count</query>
          <earliest>-60m@m</earliest>
          <latest>now</latest>
        </search>
        <option name="charting.chart">line</option>
        <option name="charting.drilldown">none</option>
        <option name="refresh.display">progressbar</option>
      </chart>
    </panel>
  </row>
</form>

[chadman]

Opps, I had * for my token and it was putting a * after my search so it looks like | WHERE LIKE(Workstation, "%src*%")

Thanks!