What is the most efficient way to use dashboard tokens for filtering?

[bcarr12]

I have a dashboard where I am using tokens to filter the results of the individual panels. The use case for the filters are:

Token=anything (*)
Token=specific_value
Token=anything BUT specific_value

I have the first two tested and working, but can't seem to figure out the best way to account for the 3rd scenario. I have been incorporating the token into my searches by using:

| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search field=$token$

This works great for scenario 1 and 2 but obviously there is no way (I think?) to leverage field=value when in the last case I want to do the opposite (!=). Is there a better way to leverage the token in my search so I will be able to filter based on all three scenarios? All values, specific value, everything NOT specific value?

Thanks!

[somesoni2 · Accepted solution]

Your token should include the condition you want to check, including the field name, and then just use the token value in the search. e.g.

Token=>field=*
Token=>field=specific_value
Token=field!=specific_value

And your search should be like

| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search $token$

[bcarr12]

I wish there was a facepalm emoji available so I could use it 🙂

I never even considered the option of using the token to specify the entire condition, I always thought it could only be used to specify a specific value. All good, this did the trick!

[niketn]

@bcarr12 if your issue is resolved please accept the answer to mark this question as answered!