index=main source=locations sourcetype=location_information
| search * AND address=$token1$ OR address="LocationXYZ"
| table site_name, address, state, country
When I run this search manually, it works fine, but when I use it in a table, it doesn't do anything
<table>
<title>Location</title>
<search>
<default>*</default>
<query>index=main source=locations sourcetype=location_information | search * AND address=$token1$ OR address="LocationXYZ" | table site_name, address, state, country </query>
</search>
</table>
I would like to use two tokens also:
search * AND address =$token1$ or address=$token2$
Try removing the search *
and move the address search to base search. Like this
index=main source=locations sourcetype=location_information (address=$token1$ OR address="token2") | table site_name, address, state, country
Your Awesome!
Sorry, seems this is giving me all the rows, not just the one's selected by the token
Did you have quotes around your tokens? Like this?
index=main source=locations sourcetype=location_information (address="$token1$" OR address="$token2$") | table site_name, address, state, country