Splunk无法填写变量

Question

谁能提出一个解释，说明为什么有时“来源”是正确的（例如 my-myapp-qa ），但是很多时候却没有格式化（ my- $ service $ -qa ）？

  <fieldset autoRun="true" submitButton="true">
    <input type="dropdown" token="service" searchWhenChanged="false">
      <label>Service</label>
      <choice value="myapp">myapp</choice>
      <choice value="otherapp">otherapp</choice>
      <default>myapp</default>
      <change>
        <condition value="deals">
          <set token="status_url">/dac/api/healthcheck</set>
        </condition>
      </change>
    </input>
    <input type="dropdown" token="environment" searchWhenChanged="false">
      <label>Environment</label>
      <choice value="qa">qa</choice>
      <choice value="dev">dev</choice>
      <choice value="ppe">ppe</choice>
      <choice value="prod">prod</choice>
      <default>ppe</default>
      <change>
        <condition value="qa">
          <set token="index">myindex</set>
          <set token="sourcetype">kubernetes-dev</set>
          <set token="source">*my-$service$-qa*</set>
        </condition>
        <condition value="dev">
          <set token="index">myindex</set>
          <set token="sourcetype">kubernetes-dev</set>
          <set token="source">*my-$service$-dev*</set>
        </condition>
      </change>
    </input>
</fieldset>