I have a checkbox named host in which user enters the hostname manually, and then as per the name entered it should display the timechart.But it still shows waiting for input even after I enter. Can anyone please help in my case. I have pasted below the XML
<query>index="xxxxx"
publisher="xxx"
(entity="*:boot*" event="FAIL-ALERT" state!="Clear")
|rex field=entity "_(?!.*_)(?<host>.*)" |eval myhost=$host$ |timechart useother=f count by myhost limit=200</query>
<earliest>-6mon@mon</earliest>
<latest>now</latest>
If you're collecting hostname from the user via a text field that becomes a token like $host$ then why are you also extracting host from the entity field?
If you want to use the token from then dashboard, then try putting $host$ in double quotes. As in: |eval myhost="$host$"
It might help to pull the query from the dashboard and run it directly in search. Be sure to substitute literals, like the hostname.
Just guessing, but perhaps it's because you have a token called 'host' as well as a field (created by rex
) called 'host'.