I presume by "custom attribute" you mean that you have a defined a field (called 'App') that shows up in your regular search results. If that's not the case, this answer is completely wrong. 🙂
So, if you want to search for a string in a field named App, you might....
... App="mysearchstring"
You might need App="mysearchstring*"
or even App="*mysearchstring*"
depending on how your string is delimited in the event but please try not to not use the wildcards if you don't need them - it'll be way faster without them, or at least without a leading wildcard.
...
is just whatever else in the search string you need to bring up the big old pile of results, some of which have App equal to that string you want. Like, source=vmware
or sourcetype=vmware
or whatever that is.
Here's a handy set of docs to help get started.
I presume by "custom attribute" you mean that you have a defined a field (called 'App') that shows up in your regular search results. If that's not the case, this answer is completely wrong. 🙂
So, if you want to search for a string in a field named App, you might....
... App="mysearchstring"
You might need App="mysearchstring*"
or even App="*mysearchstring*"
depending on how your string is delimited in the event but please try not to not use the wildcards if you don't need them - it'll be way faster without them, or at least without a leading wildcard.
...
is just whatever else in the search string you need to bring up the big old pile of results, some of which have App equal to that string you want. Like, source=vmware
or sourcetype=vmware
or whatever that is.
Here's a handy set of docs to help get started.