This works: | chart count(eval(file_date="invalid")) AS "Invalid Date Syntax"
It returns "6"
This doesn't work: | chart count(eval(*_date="invalid")) AS "Invalid Date Syntax"
It returns "0"
The documentation sez its suppose to work.
Any ideas?
Does this work:
| chart count(eval(searchmatch("*_date=\"invalid\""))) AS "Invalid Date Syntax"
What doc would that be? I'd have expected eval to treat the asterisk as multiplication.