Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to pass a different search query based on the token value from a text field

$
0
0
I have a text field with default/initial value set to "*". I wanted to use different search queries based on the values from the textfield which is mainly "*" or not "*". Any suggestion? Thanks.
**
Search No Star| makeresults | eval nonstar="$tok_text$" | stats values(nostar)-15m@mnowSearch Star| makeresults | eval star="$tok_text$" | stats values(star)-1d@dnow

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>