I have a dashboard where I am using tokens to filter the results of the individual panels. The use case for the filters are:
Token=anything (*)
Token=specific_value
Token=anything BUT specific_value
I have the first two tested and working, but can't seem to figure out the best way to account for the 3rd scenario. I have been incorporating the token into my searches by using:
| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search field=$token$
This works great for scenario 1 and 2 but obviously there is no way (I think?) to leverage field=value when in the last case I want to do the opposite (!=). Is there a better way to leverage the token in my search so I will be able to filter based on all three scenarios? All values, specific value, everything NOT specific value?
Thanks!
Your token should include the condition you want to check, including the field name, and then just use the token value in the search. e.g.
Token=>field=*
Token=>field=specific_value
Token=field!=specific_value
And your search should be like
| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search $token$
Your token should include the condition you want to check, including the field name, and then just use the token value in the search. e.g.
Token=>field=*
Token=>field=specific_value
Token=field!=specific_value
And your search should be like
| fillnull value=NULL field (this ensures value will always be equal to something, even when not in an event) | search $token$
I wish there was a facepalm emoji available so I could use it 🙂
I never even considered the option of using the token to specify the entire condition, I always thought it could only be used to specify a specific value. All good, this did the trick!
@bcarr12 if your issue is resolved please accept the answer to mark this question as answered!