Follow-on from my previous question . I ended up using a slightly different solution involving  match for the case criteria. Since the query inputs are being provided by token values to a Splunk Studio dashboard, I would not be able to properly break up and quote each term of a multi-value text input. By using match, I can just tell users to use | as a separator instead and run a search like: | eval state=case(match(foo, "^($foo_token$)$") AND match(bar, "^($bar_token$)$"), 1, NOT match(foo, "^($foo_token$)$") AND NOT match(bar, "^($bar_token$)$"), 2, 1=1, 0) However, the table cannot run this search. Even if both foo and bar have input values, the table shows "Waiting for input." If I escape the end-of-line match character like $$ or like \$, I see the same "Waiting for input." If I use only: | eval state=case(match(foo, "^($foo_token$)$"), 1, 1=1, 0) The search runs and produces expected results, so it seems to be a problem with having 2 or more $s. I want to search for whole-line values of fields only. How can I do this? ... View more

I have a dataset that looks like: (id, foo, bar, user) that I want to show results for on a dashboard. Given an input combination of values for foo and bar, I want to know which ids both     a) have at least one row that has BOTH of those values; and     b) have at least one row that has NEITHER of those values and then count the number of such ids by user. For example, a search on (foo=A, bar=1) for the data id foo bar user 1234 A 1 admin 1234 B 2 admin 1234 C 3 other_user abcd A 1 admin abcd A 2 admin   would count 1234, but not abcd, and return user ids admin 1 other_user 1   Each search parameter can be a single value or a comma-separated list. Empty values are permitted in up to one field at a time. This is the closest I have been able to get: index="data" [     | tstats count where index="data" AND foo IN (A) AND bar IN (1) by id     | fields id ] AND NOT (foo IN (A) OR bar IN (1)) | fields id, user | stats dc(id) as ids by user I believe the query does what I want it to, but unfortunately am constrained by the hard limit of 10,500 results for subsearches. Is there a way to get the data I want without an intermediate command limiting my results? ... View more