Try the following:
| eval EPHID = "EPH1406180001103"
| where like(_raw,"%".EPHID."%")
Let me give some more information:
I have a statement "eval entity="" " which is eventually set to some value which will only be a single value. Now, I need to further search the logs for this single value. Is there a way so that I search what entity equals as opposed to just its name?
Use a subsearch. Using your example as a starting point:
[| gentimes start=-1 | eval EPHID="EPH1406180001103" | rename EPHID as query | fields query ]
Presumably your search is more complex than your example. If you have a search that results in EPHID having one or more values, then the gentimes stanza will not be needed; replace gentimes and eval with that search instead. For example:
[search user="john.doe" | rename host as query | fields query]
will search for events with user "john.doe", get the host field from these, then search for that value in everything.
Having trouble understanding this. Do I need the user="john.doe" part? Why does this need to be done as a subsearch?
Try the following:
| eval EPHID = "EPH1406180001103"
| where like(_raw,"%".EPHID."%")