Currently, I have a form with a search that populates a two column table, and am using one of the columns as a key to append a third. However, I keep on getting an error message that there's an error coming from the map command, and after looking at several examples, cannot figure out what's wrong with it.
map search= "search index=a STATUS=WAIT | eval REASON=split(REASON,"/") | eval filteredVal=mvfilter(match(REASON, $$SPLITid$$))" | table filteredVal
There is an additional space after search=
. remove it
...| map search="search index=a STATUS=WAIT | eval REASON=split(REASON,"/") | eval filteredVal=mvfilter(match(REASON, $$SPLITid$$))" | table filteredVal
There is an additional space after search=
. remove it
...| map search="search index=a STATUS=WAIT | eval REASON=split(REASON,"/") | eval filteredVal=mvfilter(match(REASON, $$SPLITid$$))" | table filteredVal