Passing token to dashboard query

[nagarjuna119]

Passing a token to dashboard using below is not working, dashboard is stuck on "search is waiting for input"

message below is a json field so using spath to parse its fields, I have used the token in the title and it showed the right value, and below query works fine without token 

index="indextest" source="my source" sourcetype="ab-xyz" | spath input=message | UserName = $UserName_Token$
| table JobServiceId CreateDateTime Status UserName 

[bowesmana · Accepted solution]

There's an error in your SPL. This is not valid SPL, but maybe that's a typo

...
| UserName = $UserName_Token$
...

Did you mean?

| where UserName = "$UserName_Token$"

Note quotes

[nagarjuna119]

That worked if I select a specific value thank you.
However when I use  * as default value to return all the entires it does't return any results 

[bowesmana]

This is where the use of '| where' or '| search' is relevant.

If using where, then it's a regex, so just having * will not work, it needs to be .* but if you use search you can just use * as the wildcard, but it's less precise as using where.