Hi
I use the scheduled search below
eventtype="AppliService" Name="mfevtp"
| fields Name, host
| dedup host Name
| stats count
This search is called from the dashboard with a loadjob command
| loadjob savedsearch="admin:xx:xx"
**| search host=$tok_filterhost$**
| fields - host
| append
[ makeresults
| eval EventCode=0]
| stats sum(EventCode)
But I have an issue with | search host=$tok_filterhost$
When I delete this piece of code I have results
When there is this one, I have a 0 result even if I put an host name in my token entry
It s strange because I have already used this kind of search and it was working perfectly
is somebody has an idea please??
↧