I just ran into an issue with the accepted answer. While the $ work for a normal query. When using it in a dashboard the $123$ is evaluated as a dashboard token rather than a field. For a dashboard you must change it to single quotes.   | stats count as 123 | eval abc = round('123', 2) ... View more

It looks like as of at least Splunk Version 7.0.3.4 if you go into Lookups -> Lookup definitions and select the "Advanced options" checkbox there's now a Match type field. I just added "WILDCARD(fieldname)" there and it worked. ... View more

Thanks for this. From my testing I didn't even need the conditional on the isnum. <change> <eval token="sel_time">tostring((relative_time(now(), $latest$)-relative_time(now(), $earliest$))/60)+"m"</eval> </change> My only issue now is initializing the string. It works great on changes, but init doesn't seem to have the values in the time picker yet. ... View more

The form.token was the part I was missing. Without it I wasn't getting the token overridden when I was trying to modify a second text token. Thanks. ... View more