Why does a panel in my dashboard form report "Search is waiting for input..." when the search that powers that panel includes two aliased return fields?

[RJ_Grayson]

I'm trying to create a dashboard form with a text input box that populates a token that is used in a number of searches on the dashboard. I recently created a new panel on the dashboard and could not get it to work using the tokens from the text input.

After some trial and error I found that the search doesn't want to start when the subsearch attempts to return two aliased fields. Here is what my search looks like:

index=myindex [|inputlookup MyLookup.csv.gz | search Field=$token1$ | return customField1=$FieldA customField2=$FieldA]

If I remove one of the aliased fields from the return command in the subsearch the search starts without issue and finishes. If I keep both aliased fields in the rerturn command as seen above the search never starts after inputting data in the text box. The rest of the panels on the dashboard will load but this panel will just sit there stating "Search is waiting for input...". If I run this search with a hardcoded value where the token is in a regular search window I have no problem running the search and it returns the results I want.

Can you not return two aliased fields in a subsearch when it is part of a dashboard form or is this a bug? Has anyone else had this issue? I'm currently running 6.5.1 on the Search Head.

[woodcock]

Another way to handle this is with Character Data clause, better known as CDATA:

https://stackoverflow.com/questions/2784183/what-does-cdata-in-xml-mean

[woodcock · Accepted solution]

You are correct about the cause. To fix, edit the source XML and change all of your non-dashboard-token dollar-signs ('$') to double-dollar-signs ('$$'), like this: $$FieldA

[RJ_Grayson]

This did the trick. I looked all over the docs regarding this issue before posting here. Can you explain why the double-dollar-signs are necessary in this particular circumstance? Is this referenced anywhere in the documentation?

Thanks for the help!

[woodcock]

You are telling the XML parser to skip over (escape) it. The XML parser, and map and return and tokens (and ???) use dollar-signs as special characters so you need to make sure it gets handled by the right parser.