Hi Friends,
If I execute below highlighted query I am getting the result where when I supply the result as search it is not returning any result
index=* env=X1 SourceName=*api* [search index=* env=X1 SourceName=*api* "Transaction" | eval "TraceID"=substr(Message,85,36) | table "TraceID"]
Please help on this.
Thanks
If you run the subsearch with | format appended to it then you'll see what is added on to the main search. That has to make sense with your data to get resuits. I suspect your subsearch is producing a result like this:
(TraceID="foo" OR TraceID="bar" OR TraceID="baz")
If the events do not contain a field called "TraceID" then no results will be found.
Try this subsearch, instead.
search index=* env=X1 SourceName=*api* "Transaction" | eval "TraceID"=substr(Message,85,36) | return 1000 $TraceID
If you run the subsearch with | format appended to it then you'll see what is added on to the main search. That has to make sense with your data to get resuits. I suspect your subsearch is producing a result like this:
(TraceID="foo" OR TraceID="bar" OR TraceID="baz")
If the events do not contain a field called "TraceID" then no results will be found.
Try this subsearch, instead.
search index=* env=X1 SourceName=*api* "Transaction" | eval "TraceID"=substr(Message,85,36) | return 1000 $TraceID