Almost! Yes, using the correct case for the token is vital, but it is putting the token in double quotes which is also vital. Using case instead of if is not important. Token values are substituted ...
See more...
Almost! Yes, using the correct case for the token is vital, but it is putting the token in double quotes which is also vital. Using case instead of if is not important. Token values are substituted as a text substitution into the code of the dashboard (whether Studio or SimpleXML) before the dashboard code is executed. For example, if the searchCriteria token from the dropdown had the value "s_user", the | eval search_col = if($searchCriteria$ == "s_user", user, path) line would become | eval search_col = if(s_user == "s_user", user, path) i.e. if the s_user field has the string value "s_user". Using double quotes | eval search_col = if("$searchCriteria$" == "s_user", user, path) gives the line the intended meaning | eval search_col = if("s_user" == "s_user", user, path)