I need to evaluate different tags in the result, here is my actual code without an search, the tags are defined centrally in the tag definition for the field OBJECT_TYPE.
index="eai_tsim_account_p" host="rbedilif" | stats
count(eval(tag="WWV")) AS WWV0
count(eval('tag::OBJECT_TYPE'="WWV")) AS WWV1
count(eval(match('tag::OBJECT_TYPE',"WWV"))) AS WWV2
count(eval(like(OBJECT_TYPE,"WWV%"))) AS WWV
count(eval(like(OBJECT_TYPE,"IFT%") OR like(OBJECT_TYPE,"IFC%") OR like(OBJECT_TYPE,"XML_INVOIC%") OR like(OBJECT_TYPE,"UTILMD%") OR like(OBJECT_TYPE,"XML_EPCIS"))) AS TMS
count(eval(like(OBJECT_TYPE,"%VMI"))) AS VMI count(eval(like(OBJECT_TYPE,"INVRPTE%")OR like(OBJECT_TYPE,"DELJIT_SUPO_EMS") OR like(OBJECT_TYPE,"APERAK"))) AS EMS
count(eval(like(OBJECT_TYPE,"DELFOR") OR like(OBJECT_TYPE,"DESADV") OR like(OBJECT_TYPE,"vda%") OR like(OBJECT_TYPE,"X12%") OR like(OBJECT_TYPE,"ORD%") OR like(OBJECT_TYPE,"INVRPT") OR like(OBJECT_TYPE,"edl") OR like(OBJECT_TYPE,"DELJIT"))) AS Procurement
| transpose
This search/count is working for WWV, TMS, EMS and PROCURMENT but not for the first three tag based results WWV0, WWV1, WWV2
... View more