We created in props.conf
the following -
EVAL-mod_code = mvappend(modifier_code, modifier_code2, modifier_code3, modifier_code4, modifier_code5)
The mod_code
field is now available but I don't know how to search against it.
index=claims mod_code=U3
doesn't seem to work.
Any ideas?
Try this (the values in mvappend need to be within quotes)
index=claims | where mvfind(mod_code, "3")>=0 | ...
Try this (the values in mvappend need to be within quotes)
index=claims | where mvfind(mod_code, "3")>=0 | ...