I have two queries:
index=main
| eval var1="avalue"
| eval var2="avalue"
| search var1=var2
and
index=main
| eval var1="avalue"
| eval var2="avalue"
| search var1="avalue"
How is it that the second query returns events, whereas the the first returns none? I would think they are essentially doing the same string comparison on the final line?
Any help would be great 🙂
... View more