Token Set XML
<input type="text" token="client_subnet">
<label>client_subnet</label>
<default>*</default>
</input>
<input type="time" token="field1">
<label></label>
<default>
<earliest>-24h@h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
Inline search that works and is also the same code saved as a report
<search>
<query>index=my_index sourcetype=my_sourcetype dst=$client_subnet$
| top limit=5 src
| iplocation src
| eval percent=round(percent,2)
| rename percent as Inbound Country as "Inbound Country"
| appendcols
[ search index=my_index sourcetype=my_sourcetype src=$client_subnet$
| top limit=5 dst
| iplocation dst
| eval percent=round(percent,2)
| rename percent as Outbound Country as "Outbound Country"]
| table Inbound "Inbound Country" Outbound "Outbound Country"
| fieldformat Inbound="%".Inbound
| fieldformat Outbound="%".Outbound</query>
<earliest>$field1.earliest$</earliest>
<latest>$field1.latest$</latest>
</search>
Saved report being referenced on the dashboard that does not work with token
<panel>
<table>
<title>Top 5 Directional Traffic by Country</title>
<search ref="Top 5 Directional Traffic by Country"></search>
<option name="drilldown">none</option>
</table>
</panel>
... View more