The transaction command has the options startswith and endswith, but is there a "contains" of some sort that can be used, just to say that somewhere in the transaction there should be some field value?
I have used a regex in a match statement before like below and it seems to work fine. Maybe try that?
startswith=eval(match(eventName,".*SkipFwd"))
I have used a regex in a match statement before like below and it seems to work fine. Maybe try that?
startswith=eval(match(eventName,".*SkipFwd"))
O then you could just do a |search foo=bar
or |where foo=bar
after your transaction depending on what you are wanting to look for.
That did it - thank you MattZerfas!
My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.
Is this what you are talking about?
startswith=eval(match(yourfield,"yourvalue"))
endswith=eval(match(yourfield,"yourvalue"))
You can use regex too or even conditionals inside your eval.
See transaction reference help page.
My issue is I don't necessarily want it to start with this field value. I just want to check that the field value is somewhere in there, not necessarily the beginning or the end.