How to use tokens in the eval function when we write query in the dashboard:
I have a token with name "IN" and have to use in the query like below:
index=abc | stats count as count1| eval xyz=if(count1>=0,"$IN$",1)
index=abc | stats count as count1 | eval xyz="$IN$"
Kindly help me out on this issue.
You are doing it correctly; there must be some other problem.
So you the syntax above are not working for you? What do you get when you use this?
@somesoni2, thnx for the reply...I had some typo error in my query, as my original query is too big I could not identify it...Fixed the issue and results are seen as expected.
Then please close / delete this question since it was user error.