As @ITWhisperer points out, the token has no value so your search won't run at all to get to that point. If you want to always have a token so you search will run, you should set the default for the token to something, even if it's just the empty string, i.e. <default></default> but then your SPL would be | eval user=if(len($user_token|s$)=0, user, $user_token|s$) i.e. it checks for length of 0 in the input. Note the use of $user_token|s$, i.e. with a |s before the final $ sign which effectively quotes the token.
... View more