I have a log statement that looks list this: ipAddress=1.2.3.4,userId=42,productId=24
Currently I manually first search "ipAddress=" AND "userId=" AND "productId=" to pull out the 3 values. Then I search for the union of these fields: search "ipAddress=1.2.3.4" OR "userId=42" OR "productId=24".
How can I automated this two searches? I tried following the subsearch example but it's not working.
Hi Alice,
Have you tried something like this?
* [search ipAddress=123 AND userId=123 AND productId=123 | fields + ipAddress,userId,productId | format "(" "(" "OR" ")" "OR" ")"]