How to pass a token in base search?

[restinlinux]

i want to pass the input token to my base search.

In the panel its shows no results found, but when try click on "open in search" i can able to find the result.

whats the issue here?

<fieldset submitButton="false">
<input type="dropdown" token="Month">
<label>Month</label>
<fieldForLabel>date</fieldForLabel>
<fieldForValue>date</fieldForValue>
<search>
<query>| inputlookup test.csv
| table date</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>

<search id="bs1">

<query>index=xyz source=*.csv |eval Date="$Month$"|eval Date1=date_year + date_month |where Date1=Date |lookup test.csv date as Date OUTPUT source as Source |where source=Source</query>
<earliest>0</earliest>
<latest></latest>
</input>
</fieldset>

panel>
<single>
<title>PRODUCTION</title>
<search base="bs1">
<query>|search me |stats sum(me) as i </query>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</single>

[gcusello · Accepted solution]

Hi @restinlinux,

if in a base search you don't use a streaming command as stats or timechart, you have to use the fields command to list all the fields to use in the panels.

In your case, in the panel you have the field "me" that isn't listed in the base search so you have to add the fields command with al the fields to use in panels (me, etc...):

index=xyz source=*.csv 
| eval Date="$Month$", Date1=date_year+date_month 
| where Date1=Date 
| lookup test.csv date as Date OUTPUT source as Source 
| where source=Source
| fields me

 Ciao.

Giuseppe