help on issue between a loadjob savedsearch and a

[jip31]

hi

I called a scheduled from my dashboard

| loadjob savedsearch="admin:XX:Hardware - Battery cycle pie" 
| search Site=$tok_filtersite|s$

I have an issue with | search Site=$tok_filtersite|s$ because with it I have no results in my dashboard but if I delete it I have results

My search is this one :

| inputlookup tablet_host.csv 
| lookup toto.csv "Hostname00" as host OUTPUT CycleCount00 
| where CycleCount00 > 200 
| lookup titi.csv HOSTNAME as host output SITE 
| stats count as NbHostCycleSup300 
| appendcols 
    [| inputlookup host.csv 
    | stats count as NbIndHost] 
| eval NbHostCycleInf300 = (NbIndHost - NbHostCycleSup300) 
| eval NbHostCycleSup300=NbHostCycleSup300, NbHostCycleInf300=NbHostCycleInf300 
| table NbHostCycleSup300 NbHostCycleInf300 SITE
| rename NbHostCycleSup300 as "> 300", NbHostCycleInf300  as "< 300", SITE as Site
| transpose

So why when I add | search Site=$tok_filtersite|s$ I have no results?
thanks

[richgalloway · Accepted solution]

You get no results with | search Site=$tok_filtersite|s$ because it's searching for something that doesn't exist. There is no tok_filtersite token defined.

[jip31]

I dont understant what you mean because I retrieve the fields Site like this:
| lookup titi.csv HOSTNAME as host output SITE
| rename SITE as Site

[richgalloway]

That gives you a field called 'Site', not one called 'tok_filtersite'. Try | search Site=$Site|s$.

[jip31]

tok_filtersite is the token value of a dropdown list
In this dropdown list I retrieve the field SITE from a csv file
So when i am doing | search Site=$tok_filtersite|s$ its for doing a search from the Site valuz i have selected in my dropdown list

[richgalloway]

Thanks for the explanation.
Have you looked at the output following transpose? I believe you will not have a Site field after that.

[jip31]

thanks for your help