To get it to work, I had to put log_level="$tokLogLevel2$ in eval. <query>index=_internal sourcetype=splunkd" log_level="$tokLogLevel1$
| eval log_level="$tokLogLevel1$ | timechart count by component
| fields - "$tokSubmit1$"</query> Also, if someone tries to access a shared dashboard link that somebody worked, the submit button won't work. In order to fix that, you have to unset $form.tokLinkSubmit1$ under each <change>. <change>
<!-- Any input changes reset the Search to wait for Submit button -->
<unset token="tokSubmit1"></unset>
<unset token="form.tokLinkSubmit1"></unset>
</change>
... View more