Hi, how to me use a command split or other command that make two field from one?
Example: Im get a token with text "1** or 2**", I must use this in search | where field=$token$ that get all event with 100-299 number, or using | eval field2=split($token$," or ") and next step using a mvindex(field2, 0), but this not work. And, how to make an exception if in token is "*".
From what I understand (but I agree it is a bit unclear), he has a dashboard with a text input, resulting in a token $token$. That text input can contain a search string like "1** or 2**" which he would like to apply to a certain field to filter the results.