Hi, I have a token as below in my dashboard, <set token="mySource">replace($numSuffix$,"_","")</set> and I have another token utilising the above, <set token="source">$indexg$ connection $mySource"</set> In Query I have, <search> <query>$source$ | timechart count by host </query> </search> Unfortunately this is not working, In splunk section query, its not evaluating. Its reflecting as, index=xer connection replace(_45t66,"_","") | timechart count by host I tried with <set token="mySource">replace($numSuffix|s$,"_","")</set> But its of no use. Can someone help me with this? Thanks.
... View more