I already did the eval, but thought that it produced "mvmap" in the error message, so it's just doing it through another method. I've tried it, but the outcome is the same: <dashboard theme="dark">
<init>
<set token="token_keywords_mv">split("lorem,ipsum,situs", ",")</set>
<set token="token_keywords_starred">"*".mvjoin($token_keywords_mv$, "* OR *")."*"</set>
<set token="token_rex">"(?i)".mvjoin(mvmap('token_keywords_mv', "(?<".'token_keywords_mv'.">".'token_keywords_mv'."+?)"), "|")</set>
<eval token="token_rex_eval">"(<".mvjoin(mvzip('token_keywords_mv','token_keywords_mv',">"),"+?)|(?<")."+?)"</eval>
<set token="token_raw">(?<lorem>lorem+?)|(?<ipsum>ipsum+?)|(?<situs>situs+?)</set>
</init>
<label>Test Search</label>
<description>Multivalue</description>
<row>
<panel>
<table>
<search>
<query>index=*
[| makeresults
| eval string_search=$token_keywords_starred$
| return $string_search]
| rex field=_raw $token_raw|s$
| stats count(lorem) AS Lorem, count(ipsum) AS Ipsum, count(situs) AS Situs
| eval header="Count"
| transpose column_name="String" header_field=header</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
<row>
<panel>
<table>
<title>ECHO</title>
<search>
<query>| localop
| makeresults
| eval token_keywords_starred=$token_keywords_starred$, token_keywords_mv=$token_keywords_mv$, token_rex=$token_rex$, token_raw=$token_raw|s$, token_rex_eval=$token_rex_eval|s$</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
</search>
<option name="drilldown">none</option>
<option name="refresh.display">progressbar</option>
</table>
</panel>
</row>
</dashboard> If I replace $token_raw|s$ with any of the other tokens, it stops working.
... View more