Archive
Highlighted

Problem in report part?

I'm generating a transaction report with the help of query mentioned below.

index=sessiondata sourcetype=salejandata "$mtcn$"
| eval TXN
status = if(isnotnull(Error),"Error","Success")
| table CardNo CardDeatail TXNstatus Success Failure TotalTxn

i'm passing mtcn as dynamic value from report or dashboard.
mtcn values may be 10 or 16 digit number.

User can only provide 10 digit mtcn number while accessing report or dashboard.
But in logs where query is searching for data, there it will be 16 digit value.

Example:

user may provide mtcn number as 2342567895 in text box of Report or Dashboard.

but in log file that mtcn may be prefixed or suffixed as mentioned below.

2342567895HD3567

DER4RR2342567895

G4523425678956KK

I thought it must be working. what i did is i prefixed and suffixed mtcn token with * as mentioned "$mtcn$".
But its not working as expected.
please guide me how to achieve it.
Thanks in advance.

Shankarananth

0 Karma
Highlighted

Re: Problem in report part?

Motivator

You could use a match here, but this would be a more 'expensive' search then ...

Try:

 index=session_data sourcetype=salejandata | where match(_raw,"$mtcn$")

If the value for $mtcn$ is within a specific field, which already gets extracted, you could change the _raw for this field name.

0 Karma