My search string is
(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
Can I have a common varible in place of inputString.
I tried using using eval like below.
eval inupt=inputString|(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
But not getting result.
Any help
No, not the way you describe it.
You cannot start with an eval
that way. You might get away with something like;
host=ABC OR host=joinHost inputString | blah blah blah
Which will search through the events for inputString
, regardless of whether it appears in a field or not. But since inputString
is treated as a literal string, rather than a field value, your search may return results where inputString
is present in other parts of the event.
/k