1 case this happens is when starting the saved search from a dashboard using a token. The error occurs with syntax like this |savedsearch testsavedsearch |where Department=$Department$ IF the error occurs depends on the contents of your saved search. If you get the error you can try this syntax. |savedsearch testsavedsearch Department=$Department$ In your saved search you can also use (though not always necessary) Department=$Department$ so for example: index=main sourcetype=test Department=$Department$ |stats count(user) by Department ... View more