Hi Team, I have stats group by fields as token it will change dynamically based on time selection. for example if select since 1st Jun 24 then my query will be like below. eventtype="abc" |stats count by a,b,c and if select date before 1st Jun 2024 i.e 30th May 2024 i would like to have stats group by field like below. eventtype="abc" |stats count by a,d,e So my current implementation is putting group by field in token, token will be set based on time selection and final query would be like below. eventtype="abc" |stats count by $groupby_field$ Now the issue is splunk dashboard says waiting for input the moment i add token input to stats groupby field. Appreciate your suggestion/help to handle this scenario. Thanks, Mani
... View more