I have some data that comes in with different values and need to point them out. For example, the data can look like:
refRepId=36
OR
refrepid=125
or
refRepid=1245
1) for the first part, i need to look up anything that isn't refRepID. so i ran
mysearch NOT CASE(refRepID)
but that didn't seem to do anything. and i tried by running
mysearch CASE(refrepid) OR CASE(refRepid)
and those didn't do anyything either. (please keep in mind that refRepid and refrepid are not the only cases and there could be refrepID, rEfrepID, etc.)
2) for the second part, Here are the rules which I’m trying to achieve:
1. All refRepId values
2. Of any case, EXCEPT for the exact casing “refRepId”
3. Which are not null -> some might have refrepid= OR refrepid=somecharacters.
P.S. my search needs to contain the phrase refrepid to narrow down the search. so in reality mysearch="index=xx sourcetype=yy refrepid"
... View more