Splunk Search
Highlighted

Usage of Token for eval function in dashboard query

Communicator

Hi All,

How to use tokens in the eval function when we write query in the dashboard:

I have a token with name "IN" and have to use in the query like below:

index=abc | stats count as count1| eval xyz=if(count1>=0,"$IN$",1)

OR

index=abc | stats count as count1 | eval xyz="$IN$"

Kindly help me out on this issue.

Regards,
BK

0 Karma
Highlighted

Re: Usage of Token for eval function in dashboard query

SplunkTrust
SplunkTrust

So you the syntax above are not working for you? What do you get when you use this?

0 Karma
Highlighted

Re: Usage of Token for eval function in dashboard query

Communicator

@somesoni2, thnx for the reply...I had some typo error in my query, as my original query is too big I could not identify it...Fixed the issue and results are seen as expected.

0 Karma
Highlighted

Re: Usage of Token for eval function in dashboard query

Champion

Then please close / delete this question since it was user error.

0 Karma
Highlighted

Re: Usage of Token for eval function in dashboard query

Esteemed Legend

You are doing it correctly; there must be some other problem.

0 Karma