Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

can you help me with a token issue

$
0
0
Hi I use the scheduled search below eventtype="AppliService" Name="mfevtp" | fields Name, host | dedup host Name | stats count This search is called from the dashboard with a loadjob command | loadjob savedsearch="admin:xx:xx" **| search host=$tok_filterhost$** | fields - host | append [ makeresults | eval EventCode=0] | stats sum(EventCode) But I have an issue with | search host=$tok_filterhost$ When I delete this piece of code I have results When there is this one, I have a 0 result even if I put an host name in my token entry It s strange because I have already used this kind of search and it was working perfectly is somebody has an idea please??

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>