Why is the table not populating

[shrogers]

Hello Community,

Any assistance given will be appreciated.

Trying to figure out why my table not populating.

<form version="1.1" theme="dark">
<label>ATM Analyzer</label>
<fieldset submitButton="false" autoRun="true">
<input type="dropdown" token="status_token">
<label>Status</label>
<fieldForLabel>eventstatus</fieldForLabel>
<fieldForValue>eventstatus</fieldForValue>
<selectFirstChoice>true</selectFirstChoice>
<search>
<query>index=atm source="D:\\Program Files\\file.dat" | dedup eventstatus | table eventstatus</query>
</search>
<default>INFO</default>
<initialValue>INFO</initialValue>
</input>
<input type="dropdown" token="atm_token" searchWhenChanged="false">
<label>ATM</label>
<selectFirstChoice>true</selectFirstChoice>
<search>
<query>index=atm source="D:\\Program Files\\file.dat" | search eventstatus=$status_token$ | dedup atmnumber | table atmnumber</query>
</search>
<fieldForLabel>atmnumber</fieldForLabel>
<fieldForValue>atmnumber</fieldForValue>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="dropdown" token="event_token">
<label>Event</label>
<selectFirstChoice>true</selectFirstChoice>
<search>
<query>index=atm source="D:\\Program Files\\file.dat" | search (eventstatus=$status_token$ AND atmnumber=$atm_token$) | dedup eventtype | table eventtype</query>
</search>
<fieldForLabel>eventtype</fieldForLabel>
<fieldForValue>eventtype</fieldForValue>
<choice value="*">All</choice>
<default>*</default>
<initialValue>*</initialValue>
</input>
<input type="time" token="timerange">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<search>
<query>index=atm source="D:\\Program Files\\file.dat" where (eventstatus=$status_token$ AND atmnumber="atm_token" AND eventtype=$event_token$) | rename eventtime as Time, eventstatus as Status, atmnumner as ATM, eventtype as Fault, eventdescription as Description | table Time Status ATM Fault Description</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">20</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
</table>
</panel>
</row>
</form>

[shrogers]

Thank you. Issue resolved after using base search. Was able to identified the issue.

[shrogers]

It's being used. highlighted in bold.

<search>
<query>index=atm source="D:\\Program Files\\file.dat" where (eventstatus=$status_token$ AND atmnumber="atm_token" AND eventtype=$event_token$) | rename eventtime as Time, eventstatus as Status, atmnumner as ATM, eventtype as Fault, eventdescription as Description | table Time Status ATM Fault Description</query>

[ITWhisperer]

It is not being used as a token - try atmnumber=$atm_token$

[ITWhisperer]

It looks like atm_token is not being used as a token in your table search

[shrogers]

<search>
<query>index=atm source="D:\\Program Files\\file.dat" where (eventstatus=$status_token$ AND atmnumber="atm_token" AND eventtype=$event_token$) | rename eventtime as Time, eventstatus as Status, atmnumner as ATM, eventtype as Fault, eventdescription as Description | table Time Status ATM Fault Description</query>