I have been beating my head against a wall trying to figure this out and have not been having much luck, Ive tried everything from using appendcols, append, map, and cant get it to work.
My subsearch below returns a string
index=a | eval SPLITid=substr(SPLITLOTID,2,8) | where match(SPLITid,".")
that I need to use in my main search.
search index=b| eval REASON=split(REASON,"/") | eval filteredVal=mvfilter(match(REASON, SPLITid)) | table filteredVal
Please help.
... View more