Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to use a value created with eval to search my events for a particular line of text?

$
0
0
Hi, I am trying to use a value from an eval as search data. I am searching my events for a particular line of text and not by a field or value. This search will return any events with the text "DeployError" without using an eval index="123" sourcetype="abc" host="xyz" source=$sourceType$ "DeployError" User | timechart count by User Based on the `$sourceType$` token, the eval will have a different value. I would like to make the same type of search as above with the eval value. This is what I have tried, but it does not work. index="123" sourcetype="abc" host="xyz" source=$sourceType$ User | eval errorType=case(source=="/logs/proxy-service.log","\"DeployError\"", source=="/logs/service.log","\"BuildError\"")| search errorType | timechart count by User Any help here would be much appreciated. Thanks

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>