Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Is there a way to display a different name in a drop-down list, but use the original string value in the search using the chart replace function?

$
0
0
Hi I have a drop-down and Chart/List. The chart should show the event on the item selected from list. Is there a way display the ProcessContext_ProjectName in the drop-down list removing Java, but while searching, it should use original string? The replace function is working `replace "Java*" with "*" IN ProcessContext_ProjectName`, but while doing the search below on another chart from token_projectname2 , it should pick up from the original string including Java. Right now, the chart is always giving a blank result if I do a filter by Replace. index=u2 sourcetype=jms_body_header_txt | dedup ProcessContext_ProjectName | table ProcessContext_ProjectName0ProcessContext_ProjectNameProcessContext_ProjectName

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>