I do understand that "my_field" was just a placeholder since you did not know the name of my tokens.  My actual field is status.errorCode and creating a token "errorCode" from that does pull my results into the dashboard.  The problem comes when I tried to filter my token "errorCode" to show anything that isn't a value of 0.   I posted my code in another reply here. ... View more

Thank you for your formatting advice.  This is my first detailed post as I dive into Splunk dashboards, so I will keep that in mind moving forward. The token works fine in general with a wildcard or 0, so I didn't add more detail on how it's used because I didn't think that part needs troubleshooting.  The data is there in my results.  I figured there is a simple syntax issue that's stopping me from filtering it properly.  I'm pulling login events from Azure AD.  The field I'm working with here is status.errorCode.  I'm using two tokens - UserID and errorCode.   index="mscloud" userPrincipalName="$UserID$" status.errorCode="$errorCode$" | spath userPrincipalName | search userPrincipalName="*@company.com" | spath status.errorCode | search status.errorCode="*"| sort _time + desc | table _time createdDateTime userPrincipalName appDisplayName status.errorCode status.failureReason status.additionalDetails clientAppUsed conditionalAccessStatus   ... View more

Thank you for the tip to add the field into my condition, but this produces no results.  Leaving in * and 0 show those results, but even putting "my_field=0" shows none. ... View more