Hi all,
I'm quite new so pardon my bad exposition, I'll try my best to explain what i'm trying to achieve.
Can two fields, one from the event itself (ilo.uri), the other from an automatic lookup (il_host) be compared in a "like" fashion (ilo.uri = *il_host*) inside of a tstats search WHERE clause?
Here's my current search:
| tstats
values(ilo.level) AS "level"
FROM datamodel="b2b.ilo"
WHERE ilOutbound.level IN ("error", "warn")
### AND ilo.uri = *il_host* ###
BY _time, ilo.level
| timechart span=1h
count(level) AS "level"
BY ilo.level
... View more