Hi,
I am trying to use a value from an eval as search data. I am searching my events for a particular line of text and not by a field or value.
This search will return any events with the text "DeployError" without using an eval
index="123" sourcetype="abc" host="xyz" source=$sourceType$ "DeployError" User | timechart count by User
Based on the $sourceType$
token, the eval will have a different value. I would like to make the same type of search as above with the eval value. This is what I have tried, but it does not work.
index="123" sourcetype="abc" host="xyz" source=$sourceType$ User | eval errorType=case(source=="/logs/proxy-service.log","\"DeployError\"", source=="/logs/service.log","\"BuildError\"")| search errorType | timechart count by User
Any help here would be much appreciated. Thanks
Its possibly a typo in here, but your search errorType
will only return events with the text errorType
. Should be search errorType=*
You would need to use a subsearch, like this
Updated
index="123" sourcetype="abc" host="xyz" source=$sourceType$ User [ | gentimes start=-1 | eval search=case(match("$sourceType$","/logs/proxy-service.log"),"\"DeployError\"", match("$sourceType$","/logs/service.log"),"\"BuildError\"",1=1," ") | table search ] | timechart count by User
Hey somesoni2,
Thanks for your answer, I gave this a try but I am still getting no results found.
Try the updated answer. Also, could you provide some sample value for the field source? Does it match exactly with "/logs/proxy-service.log"?
Hey somesoni2,
Thanks again, but still no joy. Yes the source and value are the exact same, what I have provided here is made up values of what I cam doing, for confidentiality, but everything does match exactly in the real version.
index="123" sourcetype="abc" host="xyz" source=$sourceType$ User | eval errorType=case(source=="/logs/proxy-service.log","\"DeployError\"", source=="/logs/service.log","\"BuildError\"")| search errorType | timechart count by User