Splunk Search

Usage of Token for eval function in dashboard query

bharathkumarnec
Communicator

Hi All,

How to use tokens in the eval function when we write query in the dashboard:

I have a token with name "IN" and have to use in the query like below:

index=abc | stats count as count1| eval xyz=if(count1>=0,"$IN$",1)

OR

index=abc | stats count as count1 | eval xyz="$IN$"

Kindly help me out on this issue.

Regards,
BK

0 Karma

woodcock
Esteemed Legend

You are doing it correctly; there must be some other problem.

0 Karma

somesoni2
Revered Legend

So you the syntax above are not working for you? What do you get when you use this?

0 Karma

bharathkumarnec
Communicator

@somesoni2, thnx for the reply...I had some typo error in my query, as my original query is too big I could not identify it...Fixed the issue and results are seen as expected.

0 Karma

rjthibod
Champion

Then please close / delete this question since it was user error.

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.