This command does not work.
index=grb_test sourcetype=QServiceManagerFormat | source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"
This one returns results:
index=grb_test sourcetype=QServiceManagerFormat
| where source="\\\\netapp4\\Quants\\ST\logs\\dailyTest20151020_152356rhbyvk\\qservicemanager.20151020.log"
I cannot figure out a reason why. I've tried all manner of escaping the **source** field in the first search, but can't get it to work.
↧