Token manager
The Token manager panel provides a centralized area for token information in Dashboard Studio. You can view all tokens used in a dashboard, their current and default values, and which dashboard elements they are connected to, making tokens more transparent and easier to maintain.
To access the Token manager panel, click the Token manager icon in the top menu bar. The Token manager panel opens on the right.
By default, the Token manager panel displays dashboard tokens. You can use the Token type dropdown to view search tokens, environment tokens, or expression tokens. You can also search for tokens by name.
The following shows an example of the information that displays for each token:
-
Token name
-
Namespace: namespace that the token is in. A namespace provides scope for a token, making it possible to group tokens. Unless a namespace is specified, a token exists in the
defaultnamespace. No namespace displays for dashboard tokens, as in the example. -
Current value: value that the token is currently set to.
-
Default value: default value that the token is set to before the user interacts with any dashboard element that sets that token's value.
-
Used by: dashboard elements, such as an expression or visualization, that reference the token. Click the element name in the Used by field to navigate to configuration for that element. In the example, the product token is used by the Tablets single value visualization and the Purchase activity search data source.
-
Set by: dashboard elements that set the token value. Click the element name in the Set by field to navigate to configuration for that element. In the example, the product token is set by the Product dropdown and 4 single value visualizations.
For each token, you can use the copy icon to the right of the token name to copy a reference to the token. You can paste this elsewhere in the dashboard to quickly reference the token. If the token is in the default namespace, the token reference is copied in the format. $tokenName$. Otherwise, the token reference is in the format $namespace:tokenName$.
The following shows an example of the token reference for each token type:
| Token type | Token reference format example |
|---|---|
| Dashboard | $tokenName$ |
| Search | $search name:job.lastUpdated$ |
| Environment | $env:user$ |
| Conditional expression | $condition:tokenName$ |
| Evaluation expression | $eval:tokenName$ |
Specify expressions to evaluate token values
In addition to setting token values from user interactions or search results, you can set token values by evaluating custom expressions. Token evaluation expressions can evaluate to booleans, numbers, strings, or arrays. See the following examples, including some more complex use cases.
-
Combine multiple token values together, such as summing 2 products' revenues into a total revenue. See Example: Combining multiple token values together.
-
Transform a value, such as multiplying the initial value in pounds by 2.2 to get an output in kilograms. See Example: Transforming a token value.
-
Toggle visibility and labels using multiple token evaluation expressions. See Example: Toggle visibility and labels using multiple token evaluation expressions.
To create an evaluation expression, do the following:
-
In the Token manager panel, click + Create token > Evaluation expression.
-
In the Evaluation name field, enter a name for your expression. You will reference the result of the expression using the following syntax:
$eval:tokenName$. -
Under JSONata source, create your token evaluation expression. By default, this section is prepopulated with
""as a placeholder. Delete""and enter your evaluation expression. For information about JSONata syntax, see JSONata documentation. -
Click Apply and close.
-
In the Token manager panel, from the Token type dropdown, select Expression. The new token appears in the Token manager panel.
+ Create token > Evaluation expression. This option does not support configuring conditional expressions. For information about configuring conditions, see Specify visibility conditions for panels and other dashboard elements.
The following example shows how to configure an evaluation expression that evaluates the date, then displays a welcome message with that information. This evaluation uses only JSONata's built-in functions. Since the generated token, $eval:welcome message$ has no dependencies, it is evaluated once when the dashboard loads and persists until the page refreshes.
The following shows the source for this evaluation expression:
"expressions": {
"eval": {
"eval_1": {
"name": "welcome message",
"value": "'Hello!\nToday is ' & $now('[MNn,-3] [D01], [Y0001]')"
}
}
},The following shows the source code for a visualization that references the result of the expression:
"visualizations": {
"viz_5iQTl3nT": {
"options": {
"markdown": "## $eval:welcome message$"
},
"type": "splunk.markdown"
}
},Copy and paste the dashboard definition into your own dashboard to see the example:
{
"title": "Token eval expression example",
"description": "",
"inputs": {
"input_global_trp": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Global Time Range",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
},
"ds.spl2": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
}
},
"visualizations": {
"global": {
"showProgressBar": true
}
}
},
"visualizations": {
"viz_5iQTl3nT": {
"options": {
"markdown": "## $eval:welcome message$"
},
"type": "splunk.markdown"
}
},
"dataSources": {},
"layout": {
"globalInputs": [
"input_global_trp"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_5iQTl3nT",
"position": {
"h": 300,
"w": 300,
"x": 0,
"y": 0
},
"type": "block"
}
],
"type": "absolute"
}
},
"options": {},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
},
"expressions": {
"eval": {
"eval_YKKOO7sw": {
"name": "welcome message",
"value": "'Hello!\\nToday is ' & $now('[MNn,-3] [D01], [Y0001]')"
}
}
}
}Example: Combining multiple token values together
You can use token evaluation expressions to combine multiple token values together, such as summing 2 products' revenue.
The following describes the example dashboard:
-
There are 2 tables titled NovaStream Revenue and NovaAnalytics Revenue, which show monthly revenue data for 2 fictional products, NovaStream and NovaAnalytics.
-
Each table has 2 set token interactions configured:
-
One token interaction sets a ProductNameRevenue (
$NovaStreamRevenue$and$NovaAnalyticsRevenue$, respectively) token to the value of the Revenue field for the clicked value. -
Another token interaction sets a ProductNameMonth (
$NovaStreamMonth$and$NovaAnalyticsMonth$, respectively) token to the value of the Month field for the clicked value.
-
-
The single value visualization uses a data source with the following SPL query:
| makeresults | eval field="$eval:CombinedRevenue$", referencing the result of a custom evaluation expression namedCombinedRevenue. -
The
CombinedRevenuecustom expression evaluates the following:$NovaStreamRevenue$+$NovaAnalyticsRevenue$to combine the value of the 2 tokens. -
The
$NovaStreamMonth$and$NovaAnalyticsMonth$tokens are used in the title of the single value visualization to indicate which months' revenue values are combined.
Copy and paste the dashboard definition into your own dashboard to see the example:
{
"title": "Combine token values example",
"description": "",
"inputs": {
"input_global_trp": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Global Time Range",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
},
"ds.spl2": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
}
},
"visualizations": {
"global": {
"showProgressBar": true
}
}
},
"visualizations": {
"viz_TOVGvFoc": {
"dataSources": {
"primary": "ds_KDMCLRso"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row.Revenue.value",
"token": "NovaAnalyticsRevenue"
}
]
},
"type": "drilldown.setToken"
},
{
"options": {
"tokens": [
{
"key": "row.Month.value",
"token": "NovaAnalyticsMonth"
}
]
},
"type": "drilldown.setToken"
}
],
"title": "NovaAnalytics Revenue",
"type": "splunk.table"
},
"viz_e7RAgHJn": {
"dataSources": {
"primary": "ds_Mn87laXr"
},
"options": {
"unit": "$",
"unitPosition": "before"
},
"title": "$NovaStreamMonth$ NovaStream + $NovaAnalyticsMonth$ NovaAnalytics Revenue",
"type": "splunk.singlevalue"
},
"viz_mtePncjl": {
"dataSources": {
"primary": "ds_IInYYyEW"
},
"eventHandlers": [
{
"options": {
"tokens": [
{
"key": "row.Revenue.value",
"token": "NovaStreamRevenue"
}
]
},
"type": "drilldown.setToken"
},
{
"options": {
"tokens": [
{
"key": "row.Month.value",
"token": "NovaStreamMonth"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {
"columnFormat": {
"Revenue_A": {
"width": 60
}
}
},
"title": "NovaStream Revenue",
"type": "splunk.table"
}
},
"dataSources": {
"ds_IInYYyEW": {
"name": "NovaStream",
"options": {
"query": "| makeresults count=12 \n| streamstats count as month_num \n| eval _time = relative_time(strptime(\"2026-01-01\", \"%Y-%m-%d\"), \"+\" . (month_num - 1) . \"mon\") \n| eval Month = strftime(_time, \"%B\") \n| eval Revenue = (random() % 5000) + 10000 \n| table Month, Revenue"
},
"type": "ds.search"
},
"ds_KDMCLRso": {
"name": "NovaAnalytics",
"options": {
"query": "| makeresults count=12 \n| streamstats count as month_num \n| eval _time = relative_time(strptime(\"2026-01-01\", \"%Y-%m-%d\"), \"+\" . (month_num - 1) . \"mon\") \n| eval Month = strftime(_time, \"%B\") \n| eval Revenue = (random() % 10000) + 15000 \n| table Month, Revenue"
},
"type": "ds.search"
},
"ds_Mn87laXr": {
"name": "Revenue",
"options": {
"query": "| makeresults\n| eval field=$eval:CombinedRevenue$"
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_global_trp"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_mtePncjl",
"position": {
"h": 400,
"w": 420,
"x": 10,
"y": 10
},
"type": "block"
},
{
"item": "viz_TOVGvFoc",
"position": {
"h": 400,
"w": 370,
"x": 440,
"y": 10
},
"type": "block"
},
{
"item": "viz_e7RAgHJn",
"position": {
"h": 250,
"w": 430,
"x": 820,
"y": 10
},
"type": "block"
}
],
"type": "absolute"
}
},
"options": {},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
},
"expressions": {
"eval": {
"eval_V7nqJNlY": {
"name": "CombinedRevenue",
"value": "$NovaStreamRevenue$+$NovaAnalyticsRevenue$"
}
}
}
}Example: Transforming a token value
You can use token evaluation expressions to transform a value, such as multiplying a value in pounds by 2.2 to get an output in kilograms.
The following describes the example dashboard:
-
The user enters a value in pounds in the Enter weight in pounds number input.
-
The
$pounds$token, which is associated with the Enter weight in pounds number input, is set to the value that the user enters. -
The Weight converted to kilograms single value visualization uses a data source with the following SPL query:
| makeresults | eval field="$eval:convertedToKgs$ kilograms", referencing the result of a custom evaluation expression namedconvertedToKgs. -
The
convertedToKgscustom expression evaluates the following:$pounds$*2.2, multiplying the value of the$pounds$token by 2.2 to get the equivalent amount in kilograms.
{
"title": "Transform token value example",
"description": "",
"inputs": {
"input_global_trp": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Global Time Range",
"type": "input.timerange"
},
"input_pCQRy4Ip": {
"options": {
"defaultValue": 0,
"token": "pounds"
},
"title": "Enter weight in pounds",
"type": "input.number"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
},
"ds.spl2": {
"options": {
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
}
}
},
"visualizations": {
"global": {
"showProgressBar": true
}
}
},
"visualizations": {
"viz_wBa5YPbe": {
"dataSources": {
"primary": "ds_IInYYyEW"
},
"title": "Weight converted to kilograms",
"type": "splunk.singlevalue"
}
},
"dataSources": {
"ds_IInYYyEW": {
"name": "Search_1",
"options": {
"query": "| makeresults\n| eval field=\"$eval:convertedToKgs$ kilograms\""
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_global_trp"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 960,
"width": 1440
},
"structure": [
{
"item": "viz_wBa5YPbe",
"position": {
"h": 80,
"w": 250,
"x": 200,
"y": 0
},
"type": "block"
},
{
"item": "input_pCQRy4Ip",
"position": {
"h": 82,
"w": 198,
"x": 0,
"y": 0
},
"type": "input"
}
],
"type": "absolute"
}
},
"options": {},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
},
"expressions": {
"eval": {
"eval_AmFf8yNn": {
"name": "convertedToKgs",
"value": "$pounds$*2.2"
}
}
}
}Example: Toggle visibility and labels using multiple token evaluation expressions
You can configure token evaluation expressions to depend on the value of another token. You can also use token evaluation expressions to display a dynamic label. In the example dashboard, if $detailsVisibility$=true, the button displays Show overview. If $detailsVisibility$=false, the button displays Show details. In this example, multiple token evaluation expressions depend on the value of $detailsVisibility$.
The following describes the example dashboard:
-
This dashboard uses the following token evaluation expressions:
- The
toggleDetailscustom expression evaluates the following:$detailsVisibility$ = 'true' ? 'false' : 'true'.- If
$detailsVisibility$istrue, the expression evaluates tofalse. - If
$detailsVisibility$isfalse, the expression evaluates totrue.
- If
-
The
detailsBtnLabelcustom expression evaluates the following:$detailsVisibility$ = 'true' ? 'Show overview' : 'Show details'.-
If
$detailsVisibility$istrue, the expression evaluates toShow overview. -
If
$detailsVisibility$isfalse, the expression evaluates toShow details.
-
- The
-
The button is configured as follows:
- The button label is configured to display
$eval:detailsBtnLabel$, the result of the detailsBtnLabel token evaluation expression (Show overvieworShow details), as its label. -
Clicking the button sets
$detailsVisibility$to$eval:toggleDetails$, the result of thetoggleDetailstoken evaluation expression.
- The button label is configured to display
-
When the user clicks the button, the following occurs:
-
$detailsVisibility$is set to$eval:toggleDetails$, which istrueif$detailsVisibility$isfalseandfalseif$detailsVisibility$istrue.-
If
$detailsVisibility$istrue, the detailed charts (the Purchased table and Shipped line chart) display on the dashboard. -
If
$detailsVisibility$isfalse, the overview charts (the Purchased and Shipped single value visualizations) display. This is based on the conditional visibility configured for these visualizations.
-
-
The button label dynamically updates to display
$eval:detailsBtnLabel$(Show overview or Show details).
-
Copy and paste the dashboard definition into your own dashboard to see the example:
{
"title": "Order pipeline",
"description": "",
"inputs": {
"input_U0MyTulg": {
"eventHandlers": [
{
"options": {
"tokens": [
{
"token": "detailsVisibility",
"value": "$eval:toggleDetails$"
}
]
},
"type": "drilldown.setToken"
}
],
"options": {
"label": "$eval:detailsBtnLabel$"
},
"type": "input.button"
},
"input_global_trp": {
"options": {
"defaultValue": "-24h@h,now",
"token": "global_time"
},
"title": "Global Time Range",
"type": "input.timerange"
}
},
"defaults": {
"dataSources": {
"ds.search": {
"options": {
"queryParameters": {}
}
},
"ds.spl2": {
"options": {
"queryParameters": {}
}
}
},
"visualizations": {
"global": {
"showProgressBar": true
}
}
},
"visualizations": {
"viz_1Jw7tnK3": {
"containerOptions": {
"visibility": {
"hideConditions": [
"condition_VlcmN7O7"
],
"showConditions": [
"condition_PJ8UFk2j"
]
}
},
"dataSources": {
"primary": "ds_dDDDIelE"
},
"eventHandlers": [
{
"options": {
"newTab": false,
"type": "auto"
},
"type": "drilldown.linkToSearch"
}
],
"options": {
"annotationLabel": "> annotation | seriesByName('label')",
"annotationX": "> annotation | seriesByName('_time')",
"legendDisplay": "off",
"legendTruncation": "ellipsisMiddle",
"nullValueDisplay": "connect",
"seriesColorsByField": {
"count": "#118832"
},
"showRoundedY2AxisLabels": false,
"showY2MajorGridLines": true,
"xAxisMaxLabelParts": 1,
"y2": "> secondary | frameBySeriesNames('target')",
"y2AxisAbbreviation": "off",
"yAxisAbbreviation": "off",
"yAxisTitleText": "Shipped"
},
"showProgressBar": true,
"title": "Shipped",
"type": "splunk.line"
},
"viz_4eG5I5Bx": {
"containerOptions": {
"visibility": {
"hideConditions": [
"condition_JhnjlZhQ"
]
}
},
"dataSources": {
"primary": "ds_HiDWTV8m"
},
"options": {},
"title": "In cart",
"type": "splunk.singlevalue"
},
"viz_7U9ADbc1": {
"containerOptions": {
"visibility": {
"hideConditions": [
"condition_VlcmN7O7",
"condition_PJ8UFk2j"
]
}
},
"dataSources": {
"primary": "ds_1V20i37K"
},
"options": {},
"title": "Shipped",
"type": "splunk.singlevalue"
},
"viz_IRG62Fpc": {
"containerOptions": {
"visibility": {
"hideConditions": [
"condition_Z8lFOdut",
"condition_PJ8UFk2j"
]
}
},
"dataSources": {
"primary": "ds_29BrDs8T"
},
"options": {},
"title": "Purchased",
"type": "splunk.singlevalue"
},
"viz_RnPoM2iF": {
"containerOptions": {
"visibility": {
"hideConditions": [
"condition_Z8lFOdut"
],
"showConditions": [
"condition_PJ8UFk2j"
]
}
},
"context": {
"_timeColumnFormatEditorConfig": {
"time": {
"format": "YYYY-MM-DD HH:SS"
}
},
"countColumnFormatEditorConfig": {
"number": {
"thousandSeparated": false,
"unitPosition": "after"
}
},
"countRowColorsEditorConfig": [
{
"to": 1,
"value": "#D41F1F"
},
{
"from": 1,
"value": "#118832"
}
]
},
"dataSources": {
"primary": "ds_ce7q08dc"
},
"eventHandlers": [
{
"options": {
"newTab": false,
"type": "auto"
},
"type": "drilldown.linkToSearch"
}
],
"options": {
"columnFormat": {
"_time": {
"align": "auto",
"data": "> table | seriesByName(\"_time\") | formatByType(_timeColumnFormatEditorConfig)",
"headerAlign": "auto",
"textOverflow": "break-word"
},
"count": {
"align": "auto",
"data": "> table | seriesByName(\"count\") | formatByType(countColumnFormatEditorConfig)",
"headerAlign": "auto",
"rowColors": "> table | seriesByName(\"_has_stock\") | rangeValue(countRowColorsEditorConfig)",
"textOverflow": "break-word"
}
},
"font": "monospace",
"showInternalFields": false
},
"showProgressBar": true,
"title": "Purchased",
"type": "splunk.table"
}
},
"dataSources": {
"ds_1V20i37K": {
"name": "Shipped",
"options": {
"query": "| makeresults \n| eval range_random = (random() % 401) + 500 \n| table range_random",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"type": "ds.search"
},
"ds_29BrDs8T": {
"name": "Purchased",
"options": {
"query": "| makeresults \n| eval range_random = (random() % 501) + 700 \n| table range_random",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"type": "ds.search"
},
"ds_HiDWTV8m": {
"name": "In cart",
"options": {
"query": "| makeresults \n| eval range_random = (random() % 1001) + 500 \n| table range_random",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"type": "ds.search"
},
"ds_ce7q08dc": {
"name": "Purchased table",
"options": {
"query": "| makeresults count=20 \n| streamstats count as Order_ID \n| eval _time = _time - (random() % 86400 * 30)\n| eval Order_Date = strftime(_time, \"%Y-%m-%d %H:%M\")\n| eval Product_Name = \"NovaStream\"\n| eval Quantity = (random() % 5)+1\n| eval Unit_Price = 299.99\n| eval Total_Price = Quantity * Unit_Price\n| eval Status = case((random() % 10) < 7, \"Shipped\", (random() % 10) < 9, \"Pending\", 1=1, \"Cancelled\")\n| table Order_ID, Order_Date, Product_Name, Quantity, Unit_Price, Total_Price, Status\n| sort - Order_Date",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"type": "ds.search"
},
"ds_dDDDIelE": {
"name": "Shipped line chart",
"options": {
"query": "| makeresults count=300 \n| streamstats count as increment \n| eval _time = _time - (increment * 8640)\n| eval Product = \"NovaStream\"\n| eval Order_Count = (random() % 15) + 5 \n| timechart span=1d sum(Order_Count) as \"Daily Orders\"",
"queryParameters": {
"earliest": "$global_time.earliest$",
"latest": "$global_time.latest$"
}
},
"type": "ds.search"
}
},
"layout": {
"globalInputs": [
"input_global_trp"
],
"layoutDefinitions": {
"layout_1": {
"options": {
"display": "auto",
"height": 1005,
"width": 1440
},
"structure": [
{
"item": "viz_4eG5I5Bx",
"position": {
"h": 180,
"w": 660,
"x": 10,
"y": 50
},
"type": "block"
},
{
"item": "viz_IRG62Fpc",
"position": {
"h": 240,
"w": 360,
"x": 10,
"y": 240
},
"type": "block"
},
{
"item": "viz_RnPoM2iF",
"position": {
"h": 240,
"w": 660,
"x": 10,
"y": 240
},
"type": "block"
},
{
"item": "viz_7U9ADbc1",
"position": {
"h": 240,
"w": 360,
"x": 10,
"y": 500
},
"type": "block"
},
{
"item": "viz_1Jw7tnK3",
"position": {
"h": 240,
"w": 660,
"x": 10,
"y": 500
},
"type": "block"
},
{
"item": "input_U0MyTulg",
"position": {
"h": 82,
"w": 150,
"x": 10,
"y": 0
},
"type": "input"
}
],
"type": "absolute"
}
},
"options": {
"submitButton": false
},
"tabs": {
"items": [
{
"label": "New tab",
"layoutId": "layout_1"
}
]
}
},
"expressions": {
"conditions": {
"condition_PJ8UFk2j": {
"name": "show details",
"value": "$detailsVisibility$ = \"true\""
}
},
"eval": {
"expr_1": {
"name": "detailsBtnLabel",
"value": "$detailsVisibility$ = 'true' ? 'Show overview' : 'Show details'"
},
"expr_2": {
"name": "toggleDetails",
"value": "$detailsVisibility$ = 'true' ? 'false' : 'true'"
}
}
},
"applicationProperties": {
"hideEdit": false,
"hideExport": false
}
}Use dashboard filters in logs chart queries
Use tokens in a logs chart SPL query to apply dashboard filter values when the chart runs.
Dashboard filters can pass selected values to a logs chart query. Add a token where you want a filter value to be inserted, then add a dashboard filter with a matching key.
The chart query uses the selected filter values. For example, if a user selects checkout, service=$service$ behaves like service="checkout".
If the filter is missing or has no selected value, the token does not narrow the query. For example, host=$host$ behaves like host=*. A dashboard filter that is not referenced by a token does not affect the chart.
Query examples
Use the following patterns in a logs chart SPL query:
-
Filter one field:
index=main host=$host$ -
Filter several fields:
index=main host=$host$ service=$service$ env=$environment$ -
Use a token in a pipeline:
index=main service=$service$ | stats count by host -
Use a dotted field name:
index=main k8s.node.name=$node$. If needed, quote the field name:"host.name"=$host$. -
Use the same token more than once in a query.
A single selected value, such as checkout, makes service=$service$ behave like service="checkout". Multiple selected values make it behave like service IN ("checkout","payments","cart").
For an exclude filter, env=$env$ behaves like env!="dev" for one excluded value. For multiple excluded values, it behaves like NOT env IN ("dev","test").
If the chart does not respond to a filter, check that:
-
The token name exactly matches the dashboard filter key.
-
The token uses the format
fieldName=$filterKey$. -
The token is in the SPL query for that logs chart.
-
The filter is on the same dashboard as the chart.
-
The SPL field on the left side of the equals sign is the field you want to filter.