Hello Everyone,
Am creating the dynamic query depending on condition and after that using return
command to execute that search query string, below is my search query
[ | search query which gives me dynamic string.... | return $myquery ]
where $myquery contain index=xyz | stats c(eval(eventtype="myeventtype1")) as "myeventtype1", c(eval(eventtype="myeventtype2")) as "myeventtype2"
but its giving me the error (actually its putting the each eventtype value while executing), is there any way where we can execute this query without any error?
Note: when i execute myquery string manually its perfectly working fine.
Can any on help me here?
Thank you
Why bother with the extra stuff; just do this ( search
is a special field name returning from subsearches):
[ | search query which gives me dynamic string.... | rename myquery AS search ]