Search should be saved as
saved_search_name
index=xyz KEY_1=123 KEY_2=456 HOST_NAME=$HOST_NAME$
When using in a dashboard it should be
<input type="text" token="HOST_NAME" searchWhenChanged="false">
<label>Host</label>
<default>*</default>
</input>
| savedsearch saved_search_name HOST_NAME =$HOST_NAME$
This works perfectly
... View more
Just to be more clear.
Search should be saved as
saved_search_name
index=xyz KEY_1=123 KEY_2=456 host=$host$
When using in a dashboard it should be
| savedsearch saved_search_name host=$host$
... View more