Passing tokens dynamically to search query

[k_harini]

I have a drop down which I populate with the query and editing field values
index="myindex"|stats values(Category) as categories|rex field=categories mode=sed "s/Change Request/CR/" |rex field=categories mode=sed "s/Central Functions/CF/"| mvexpand categories|eval label= categories |eval value = categories

Now since I had changed drop down values how will i pass the original field value as token to my search query where it will work
index="myindex" Category=$categories$| chart count over sourcetype by "Priority" | addtotals fieldname=Total| foreach * [eval Req_Percent = count *100 / Total] | fields - Total

This is not working.. I want to pass the category i select from drop down and change it to field value and pass to query.. How can i accomplish that.. Please help

[sundareshr]

Try this

index="myindex" | rex field=categories mode=sed "s/Change Request/CR/" | rex field=categories mode=sed "s/Central Functions/CF/"| mvexpand categories |  search Category="$categories$" | chart count over sourcetype by "Priority" | addtotals fieldname=Total| foreach * [eval Req_Percent = count *100 / Total] | fields - Total

[gcusello]

if you open the search dashboard from your panel, what you find instead of $categories$?
Bye.
Giuseppe

[k_harini]

I get no results found.. When i give query with full field values, its displaying correctly

[gcusello]

Open your search in the search dashboard, you should have something like this:

index="myindex" Category=$categories$|...

or

index="myindex" Category=Category=$categories$| ...

or something else, in other words: what you have after Category=?.

Every way make another try, if some values of category are strings with spaces:
index="myindex" Category="$categories$"| ...
put double quotes around token.

Bye.
Giuseppe

[k_harini]

I added double quotes. Reason its not displaying is.. I have used rex in dropdown query and modified the values in drop down (reduced field values length).. when i pass those values to search, they are not there in my log and not getting displayed. Problem here is I'm not able to add rex as calculated field in props file.. Any idea on how to add this as calculated field? Thanks!

[nagarjuna560]

Harini,
did you find a solution to this issue?