Your token usage in your example is inside a <change> block, so unless that data is being changed, then it will not trigger the change event to set the Panel* tokens. I have in the past done something similar by using a dashboard level or hidden panel search that does something like this | makeresults | eval tokVal=$dc_no_tok$, tokHost=$host_tok$ | table tokVal tokHost and then the <done> clause of the search will do <done> <condition match="$result.tokHost$=&quot;consul_server&quot;> <set token=...></set> </condition> <condition match="$result.tokHost$=&quot;consul_client&quot;> <set token=...></set> </condition> </done> I don't know if that's the 'right' solution - but as always with Splunk there are often several 'right' ways to achieve the same outcome.   ... View more

@lping you should have accepted the previous elaborate answer, as that covered the solution for the issue posted. However, do upvote the comments / answers that assisted resolving your issue! ... View more