Given variable as value of field and not token

[woodman2]

I have such a search and it works fine but not in Dashboard!

index=unis | search *sarch* | eval name = coalesce(C_Name, PersonName) | eval "DoorName"=if(sourcetype=="ARX:db", $Door$,$DoorName$)

when I use this is in a dashboard it looks for Door and DoorName as tokens while they are values of those fields what should I do to make it work in dashboard studio

error I get :

Set token value to render visualization

• $Door$
• $DoorName$

edit: if I remove all $  it still works same as in search but still not working in dashboard (without any error) it returns result but DoorName field will be empty

[gcusello]

Hi @woodman2 ,

at first, don't use the search command after the main search, because you have a slower search.

then, what are $Door$ and $Doorname$?

in Splunk they are tokens defined in a dashboard.

If you have a variable or a field with this name it cannot run in a search.

Ciao.

Giuseppe

[woodman2]

Door and Doorname are field name that exist in my search result they have values and my search works fine with them unless I use them in a dashboard because it counts them as tokens and not taking their values from my results

[gcusello]

Hi @woodman2 ,

as I said, dollar char at the borders of a word is the way in Splunk to identify tokens, so you cannot use this format for your fields.

you mast modify your searches and you data structure.

Ciao.

Giuseppe

[woodman2]

if it's wrong ... so how it works in search? my result are correct until I use my search in dashboard

[gcusello]

Hi @woodman2 ,

if you have a field whose name begins and ends with $, the search works because it finds this field, but in the Splunk dashboard it interprets the formalism not as a field, but as a token that has not been passed and therefore remains hanging.

As I said: you cannot use this format for your fields.

Ciao.

Giuseppe