I recreated the dashboard using the report search and have the search returning all of the table results. I have an input for the reference number as a text box. The token name is: **purchCostReferenceToken**
I want to limit the table results based on this token. This is the search:
Where do I add the token to limit the search?
I tried adding this to the end of the search before the table command:
... | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) purchCostReference=$purchCostReferenceToken$ | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time
I get an error...**error in convert command: the argument purchCostReference- is invalid**
I would like to add filters in several of the table columns. The purchCostReference value is an extracted field in the search using **xmlkv**
↧