Error when trying to add token to limit table results in a search?

[3618475]

I recreated the dashboard using the report search and have the search returning all of the table results. I have an input for the reference number as a text box. The token name is: purchCostReferenceToken

I want to limit the table results based on this token. This is the search:

 <form>
      <label>Thru Train Dashboard</label>
      <fieldset submitButton="false" autoRun="true">
        <input type="text" token="purchCostReferenceToken" searchWhenChanged="true">
          <label>Enter a TMS Reference Number to Filter Table</label>
          <default>*</default>
          <initialValue>*</initialValue>
        </input>
      </fieldset>
      <row>
        <panel>
          <title>Thru Train Data</title>
          <table>
            <search>
              <query>index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |eval Segments =  mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\<carrier\>(?P<Carriers>[^\<]+)" | rex max_match=0 "\<billingMethod\>(?P<BillingMethod>[^\<]+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<origin>\s*<ns2:numberCode>(?P<Origin>\d+)"  | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<destination>\s*<ns2:numberCode>(?P<Destination>\d+)" | rex max_match=0 "<purchasedCostTripSegment>[\s\S]*?<stopOff>\s*<ns2:stopOffLocation>\s*<ns2:numberCode>(?P<StopOffLocation>\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time</query>
              <earliest>-30d@d</earliest>
              <latest>now</latest>
            </search>
            <option name="drilldown">none</option>
          </table>
        </panel>
      </row>
    </form>

Where do I add the token to limit the search?
I tried adding this to the end of the search before the table command:

 ...   | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) purchCostReference=$purchCostReferenceToken$ | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time

I get an error...error in convert command: the argument purchCostReference- is invalid
I would like to add filters in several of the table columns. The purchCostReference value is an extracted field in the search using xmlkv

[richgalloway · Accepted solution]

If the tokenized fields are automatically extracted then include the tokens in the base search. For example,

index=... "<billingMethod>RULE</billingMethod>" "createMessage MsgSource" purchCostReference=$purchCostReferenceToken$ | xmlkv ...

If the fields aren't automatically extracted then put the tokens after the field extraction.

... | xmlkv | rex max_match=0 "\<purchasedCostTripSegment\>(?P<segment>[^\<]+)" |search  segment=$purchCostReferenceToken$ | eval Segments = ....

[3618475]

Thanks! That worked

[3618475]

In my case I just had to add "$purchCostReferenceToken$" to the query