hi
I called a scheduled from my dashboard
| loadjob savedsearch="admin:XX:Hardware - Battery cycle pie"
| search Site=$tok_filtersite|s$
I have an issue with | search Site=$tok_filtersite|s$
because with it I have no results in my dashboard but if I delete it I have results
My search is this one :
| inputlookup tablet_host.csv
| lookup toto.csv "Hostname00" as host OUTPUT CycleCount00
| where CycleCount00 > 200
| lookup titi.csv HOSTNAME as host output SITE
| stats count as NbHostCycleSup300
| appendcols
[| inputlookup host.csv
| stats count as NbIndHost]
| eval NbHostCycleInf300 = (NbIndHost - NbHostCycleSup300)
| eval NbHostCycleSup300=NbHostCycleSup300, NbHostCycleInf300=NbHostCycleInf300
| table NbHostCycleSup300 NbHostCycleInf300 SITE
| rename NbHostCycleSup300 as "> 300", NbHostCycleInf300 as "< 300", SITE as Site
| transpose
So why when I add | search Site=$tok_filtersite|s$
I have no results?
thanks
You get no results with | search Site=$tok_filtersite|s$
because it's searching for something that doesn't exist. There is no tok_filtersite
token defined.
You get no results with | search Site=$tok_filtersite|s$
because it's searching for something that doesn't exist. There is no tok_filtersite
token defined.
I dont understant what you mean because I retrieve the fields Site like this:
| lookup titi.csv HOSTNAME as host output SITE
| rename SITE as Site
That gives you a field called 'Site', not one called 'tok_filtersite'. Try | search Site=$Site|s$
.
tok_filtersite is the token value of a dropdown list
In this dropdown list I retrieve the field SITE from a csv file
So when i am doing | search Site=$tok_filtersite|s$ its for doing a search from the Site valuz i have selected in my dropdown list
Thanks for the explanation.
Have you looked at the output following transpose
? I believe you will not have a Site field after that.
thanks for your help