Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

My search works when I run it manually, but why does it not produce results when I use it to populate a table?

$
0
0
index=main source=locations sourcetype=location_information | search * AND address=$token1$ OR address="LocationXYZ" | table site_name, address, state, country When I run this search manually, it works fine, but when I use it in a table, it doesn't do anythingLocation*index=main source=locations sourcetype=location_information | search * AND address=$token1$ OR address="LocationXYZ" | table site_name, address, state, country
I would like to use two tokens also: search * AND address =$token1$ or address=$token2$

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>