Hi everyone,
I am trying to do the following in splunk but its not working:
index=MRM eventtype=MRM_ERROR |
eval Description=case(
like(search, "%error1%"),"error1",
like(search, "%error2%"),"error2"
) | chart count by Description
Any ideas?
↧