Hi,
i need to get the raw data of file based on source file name. For that i have used below query.
source="xml_file_1.xml" | table _raw
This is giving results only for local indexes, but not the virtual indexes.
I tried below queries as well,
index ="hdfs_index" | search source="xml_file_1.xml" | table _raw
index ="hdfs_index" WHERE source="xml_file_1.xml" | table _raw
But, none has given results.
What went wrong.
Is there a way that i can match the source file name.?
↧