I'm trying the below query,
index=XXXXXXXXX | eval space="cf_space_name=production" | search "space" YYYYYYYYYYYY | stats count
===================================================================
I want to filter the results based on the evaluated field.
| search "space" XXXXXXXXXXXXX => is not returning correct values
| search "cf_space_name=production" XXXXXXXXXXXXX => but If I use the value like this its working.
how to fix this? Thanks for the help.
Like @richgalloway mentioned, the value in 'space' is not substituted as part of command in | search. Can you explain why it is even necessary to use that syntax if | search "cf_space_name=production" YYYYYYYYYYY already works? Maybe you are thinking of a token in dashboard?
(As a side, | search "cf_space_name=production" YYYYYYYYYYY is semantically different from | search cf_space_name=production YYYYYYYYYYY. You want to consider what exactly is intended.)
I have two inputs in the dashboard and I need to evaluate filed name and value to compare dynamically based on those inputs and filter events based on that. That is what I'm tryign to do.
I still don't see how "cf_space_name=production" is a dynamic input. In this form, it is just a static string. Can you explain? Maybe you can illustrate with data (anonymize as necessary)?
I hoping this was in a dashboard. If you have an input called "space" that holds a cf_space_name value then you can reference that token in the SPL.
index=XXXXXXXXX cf_space_name=$space$ YYYYYYYYYYYY
| stats count
The search command treats "space" with or without quotation marks as a literal string rather than a field name.
The eval command assigns a value to a field, creating the field if necessary. It does not define variables that can be used in arbitrary places.
To search for specific text in an event, put that text in a search command.