Usage of Token for eval function in dashboard query

[bharathkumarnec]

Hi All,

How to use tokens in the eval function when we write query in the dashboard:

I have a token with name "IN" and have to use in the query like below:

index=abc | stats count as count1| eval xyz=if(count1>=0,"$IN$",1)

OR

index=abc | stats count as count1 | eval xyz="$IN$"

Kindly help me out on this issue.

Regards,
BK

[woodcock]

You are doing it correctly; there must be some other problem.

[somesoni2]

So you the syntax above are not working for you? What do you get when you use this?

[bharathkumarnec]

@somesoni2, thnx for the reply...I had some typo error in my query, as my original query is too big I could not identify it...Fixed the issue and results are seen as expected.

[rjthibod]

Then please close / delete this question since it was user error.