Hi,
I am trying to use a value from an eval as search data. I am searching my events for a particular line of text and not by a field or value.
This search will return any events with the text "DeployError" without using an eval
index="123" sourcetype="abc" host="xyz" source=$sourceType$ "DeployError" User | timechart count by User
Based on the `$sourceType$` token, the eval will have a different value. I would like to make the same type of search as above with the eval value. This is what I have tried, but it does not work.
index="123" sourcetype="abc" host="xyz" source=$sourceType$ User | eval errorType=case(source=="/logs/proxy-service.log","\"DeployError\"", source=="/logs/service.log","\"BuildError\"")| search errorType | timechart count by User
Any help here would be much appreciated. Thanks
↧