Hi, I have a lot of dashboards currently using standard search or tstats with a WHERE filter. The token for the filter is populated by a multi-select that sets the value to something like index=foo OR index=bla . However, in the same dashboard I have | pivot panels as well, and these use a different FILTER syntax, but I want the same filter from the token applied to both search/tstats and pivot style searches. Pivot would require the following syntax: FILTER index inList (foo,bar) I've tried the following to get this to work: In the multi-select <change><eval token="pivot_style_filter">replace(replace(old_style_filter,"index=", "")," OR ",",")</eval></change> However this only replaces the last entered value of the multi-select (last checked item) I've also tried doing this with a macro in-line in the | pivot search, but the macro isn't expanded in this syntax: | pivot ... FILTER index inList (`replace_old_style_filter`). The backticks and everything is passed into the search log sent to the indexers. Does anyone have an excellent solution to this matter? I don't really get why pivot can't accept the WHERE style filtering as well as FILTER style filtering. My temporary workaround was to hack out the generated tstats command out of the search job inspector and use that for the searches, but this breaks drilldowns and prevents real-time searches from being done. It is also more work to maintain since you cannot simply reverse a tstats search back to a pivot search just like that. ... View more