I'm trying to populate my drop down list with extracted fields of a search, most examples I've seen on splunkbase explain it quite well, but I don't think I'm getting the syntax right, how do I set the 'fields' as the token to pass to my populating search? I currently have this: <! -- default search to assign tokens ---> index=main host=gridnames | fields gridnames | dedup gridnames <!- set $grid$ here: HOW?> Select grid <![CDATA[index="main" host=gridnames| fields grid | dedup grid]]> default I know I'm not setting $grid$ in the searchtemplate, but how do I do it for the field gridnames? ... View more