Hello!
I've been looking around for an answer to this one, either it eludes me or I'm straight up asking the wrong question.
I'm trying to create a hideous search utilizing the where like functions.
My search currently looks similar to this:
index="someindex" | lookup somelookup.csv LookupField as EventField output LookupField | search NOT LookupField=* |
where like(EventField,"%ext") OR like(EventField,"t%xt") OR like(EventField,"te%t") OR like(EventField,"tex%") | further transforming etc
What I''m looking to achieve and make my life a little easier and potentially a better search all round is where the text within the like function is replaced with text brought in from a lookup, as far as i can tell this is not possible which means creating lots of similar searches .
If anyone can point me in the right direction that'd be grand or have another approach to this search.
Thanks in advance!
... View more