I know this is an old post, but just adding a sample
Putting an example to make it simpler
good practice to put "_tok" in the token name, so it is not confused with field/label names
also try to query wrapped in CDATA just to ensure double quotes, arrow symbols won't cause problems
uses "search" rather than the deprecated "populatingSearch" notation
and is a working dashboard (to try out)
sample code
<form>
<label>REMOVE THIS DASHBOARD ANYTIME</label>
<description>Some Description</description>
<fieldset autoRun="false">
<input type="dropdown" token="sourcetype_tok" searchWhenChanged="false">
<label>label_name</label>
<choice value="*">All</choice>
<selectFirstChoice>true</selectFirstChoice>
<search>
<query>
<![CDATA[index=_internal | stats count by sourcetype
]]>
</query>
<earliest>$timeSpan.earliest$</earliest>
<latest>$timeSpan.latest$</latest>
</search>
<fieldForLabel>sourcetype</fieldForLabel>
<fieldForValue>sourcetype</fieldForValue>
</input>
<input type="time" token="timeSpan">
<label>Time Picker</label>
<default>
<earliest>-1h</earliest>
<latest>now</latest>
</default>
</input>
</fieldset>
<row>
<panel>
<table>
<title>Event Details</title>
<search>
<query>
<![CDATA[index=_internal sourcetype=$sourcetype_tok$
| head 1000
| table _time,index,sourcetype,source,_raw
]]>
</query>
<earliest>$timeSpan.earliest$</earliest>
<latest>$timeSpan.latest$</latest>
</search>
<option name="count">20</option>
</table>
</panel>
</row>
</form>
... View more
