index=main source=locations sourcetype=location_information
| search * AND address=$token1$ OR address="LocationXYZ"
| table site_name, address, state, country
When I run this search manually, it works fine, but when I use it in a table, it doesn't do anything
I would like to use two tokens also:
search * AND address =$token1$ or address=$token2$
↧