https://community.splunk.com/t5/Reporting/Problem-in-report-part/m-p/249496#M10751 <P>You could use a <CODE>match</CODE> here, but this would be a more 'expensive' search then ...</P> <P>Try:</P> <PRE><CODE> index=session_data sourcetype=salejandata | where match(_raw,"$mtcn$") </CODE></PRE> <P>If the value for $mtcn$ is within a specific field, which already gets extracted, you could change the <CODE>_raw</CODE> for this field name.</P> Wed, 16 Mar 2016 09:48:13 GMT DMohn 2016-03-16T09:48:13Z https://community.splunk.com/t5/Reporting/Problem-in-report-part/m-p/249495#M10750 <P>I'm generating a transaction report with the help of query mentioned below.</P> <P>index=session_data sourcetype=salejandata "$mtcn$"<BR /> | eval TXN_status = if(isnotnull(Error),"Error","Success")<BR /> | table CardNo CardDeatail TXN_status Success Failure Total_Txn</P> <P>i'm passing mtcn as dynamic value from report or dashboard.<BR /> mtcn values may be 10 or 16 digit number.</P> <P>User can only provide 10 digit mtcn number while accessing report or dashboard. <BR /> But in logs where query is searching for data, there it will be 16 digit value.</P> <P>Example:</P> <P>user may provide mtcn number as 2342567895 in text box of Report or Dashboard.</P> <P>but in log file that mtcn may be prefixed or suffixed as mentioned below.</P> <P>2342567895HD3567</P> <P>DER4RR2342567895</P> <P>G4523425678956KK</P> <P>I thought it must be working. what i did is i prefixed and suffixed mtcn token with * as mentioned <EM>"$mtcn$"</EM>.<BR /> But its not working as expected.<BR /> please guide me how to achieve it.<BR /> Thanks in advance.</P> <P>Shankarananth</P> Tue, 29 Sep 2020 09:06:59 GMT https://community.splunk.com/t5/Reporting/Problem-in-report-part/m-p/249495#M10750 Shan 2020-09-29T09:06:59Z https://community.splunk.com/t5/Reporting/Problem-in-report-part/m-p/249496#M10751 <P>You could use a <CODE>match</CODE> here, but this would be a more 'expensive' search then ...</P> <P>Try:</P> <PRE><CODE> index=session_data sourcetype=salejandata | where match(_raw,"$mtcn$") </CODE></PRE> <P>If the value for $mtcn$ is within a specific field, which already gets extracted, you could change the <CODE>_raw</CODE> for this field name.</P> Wed, 16 Mar 2016 09:48:13 GMT https://community.splunk.com/t5/Reporting/Problem-in-report-part/m-p/249496#M10751 DMohn 2016-03-16T09:48:13Z