I schedule below search, search name is "TransactionResult"
sourcetype="ims*" host="chi*" ActivityId!="(null)" (Action="Start" OR Action="End") | eval TopicName= mvindex(split(TopicName,"."),-1) | transaction ActivityId TopicName startswith="Start" endswith="End" maxevents=2 | fields FirmName ActivityId TopicName duration _time | collect addtime=true index=summary_abuse
After above search completed, I use
"index=summary_abuse search_name="TransactionResult" to get the result of search , but the result is empty ,why?
... View more