Hello, My objective is to exclude anything the user input from an input text in a dashboard. Search string: index = index_string sourcetype = stype_string |eval host = mvindex(fields ,10) | where NOT host in ("$host_token$") Input xml like this: <input type="text" token="host_token"> <label>Host</label> <default></default> </input> The above works only for a single input in the textbox. ex. host1 But if multiple host it doesn't work. Nothing is filtered and all below host shows ex. host1,host2,host3
... View more