Say I have a search like this, trying to find all the events that occurred on hosts around the some_text event:
index=_internal host=host1 OR host=host2 source=splunkd.log some_text | localize | map search="search index=_internal"
How do I tell localize and map to only search over the hosts that matched in the original search? I tried adding host=$host$ to the map search, as the documentation indicates, but I get the error that it did not find value for required attribute host. Will the syntax change if I use it in a dashboard?