Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Error when trying to add token to limit table results in a search?

$
0
0
I recreated the dashboard using the report search and have the search returning all of the table results. I have an input for the reference number as a text box. The token name is: **purchCostReferenceToken** I want to limit the table results based on this token. This is the search:
**
Thru Train Dataindex=... "RULE" "createMessage MsgSource" | xmlkv | rex max_match=0 "\(?P[^\<]+)" |eval Segments = mvrange(1,mvcount(mvindex(segment, 0, 2))+1,1) | rex max_match=0 "\(?P[^\<]+)" | rex max_match=0 "\(?P[^\<]+)" | rex max_match=0 "[\s\S]*?\s*(?P\d+)" | rex max_match=0 "[\s\S]*?\s*(?P\d+)" | rex max_match=0 "[\s\S]*?\s*\s*(?P\d+)" | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time-30d@dnow
Where do I add the token to limit the search? I tried adding this to the end of the search before the table command: ... | eval Time =_time | convert timeformat="%m-%d-%Y %H:%M:%S" ctime(Time) purchCostReference=$purchCostReferenceToken$ | table purchCostReference, eventType, Time, Segments, Carriers, BillingMethod, Origin, Destination, StopOffLocation | sort Time I get an error...**error in convert command: the argument purchCostReference- is invalid** I would like to add filters in several of the table columns. The purchCostReference value is an extracted field in the search using **xmlkv**

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>