It looks like the token name parser of Splunk contains a bug, otherwise why would it expect to find a token in this eval expression which I simplified for better clarity: eval x=if(match(url,"test$"),if(match(url,"onemoretest$"),"",""),"","")  I know that if I change it to double $$ it will work OK: eval x=if(match(url,"test$$"),if(match(url,"onemoretest$"),"",""),"","") Because of this alleged bug, my dashboard doesn't work properly. It seems that the token parser doesn't recognize any stop characters (like ",) and even space etc.) outside the allowed range of characters for token naming. Any help would be greatly appreciated! ... View more