Hi all,
I am trying to pass a text box input in a dashboard called token ID1 which works fine but the issue here is that I am using the $ sign again to do a 2nd search from a field extract ID3 from index idx1 with a map search on index idx2 with the field that was extracted ID3.
The issue here I think is that the dashboard is expecting an input for ID3 because I am using the $ sign. As this search works fine when done in splunk search by manually passing ID1. How do I make the dashboard understand that it doesn't need an input for ID3?
index=idx1 $ID1$ | rex field=_raw "(?.*?)<.*?someString"(?.*?)">(?.*?)somemorestring" | dedup ID3 | map search="search (\"string1 with spaces\" OR string2 OR string3 OR \"string 4 with spaces\" OR \"string 5 with spaces\" OR \"string6\") index=idx2 $ID3$ "
Hope this makes sense,
Thanks for your help.
Tom
... View more