host=dummy | eval Pattern='arb_usg_mps%06' | where like (source,'%Pattern%')
doesnot work . can you help what's wrong in this? But events do exists.
This should work (you had extra spaces and other small problems)
| makeresults | eval source="fooarb_usg_mpsbar06foobar::fooarb_usg_mpsbar07foobar"
| makemv delim="::" source
| mvexpand source
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| eval Pattern="%arb_usg_mps%06%"
| where like(source, Pattern)
This should work (you had extra spaces and other small problems)
| makeresults | eval source="fooarb_usg_mpsbar06foobar::fooarb_usg_mpsbar07foobar"
| makemv delim="::" source
| mvexpand source
| rename COMMENT AS "Everything above generates sample event data; everything below is your solution"
| eval Pattern="%arb_usg_mps%06%"
| where like(source, Pattern)
Thanks it worked:)