I'm generating a transaction report with the help of query mentioned below.
index=sessiondata sourcetype=salejandata "$mtcn$"
| eval TXNstatus = if(isnotnull(Error),"Error","Success")
| table CardNo CardDeatail TXNstatus Success Failure TotalTxn
i'm passing mtcn as dynamic value from report or dashboard.
mtcn values may be 10 or 16 digit number.
User can only provide 10 digit mtcn number while accessing report or dashboard.
But in logs where query is searching for data, there it will be 16 digit value.
user may provide mtcn number as 2342567895 in text box of Report or Dashboard.
but in log file that mtcn may be prefixed or suffixed as mentioned below.
I thought it must be working. what i did is i prefixed and suffixed mtcn token with * as mentioned "$mtcn$".
But its not working as expected.
please guide me how to achieve it.
Thanks in advance.
You could use a match here, but this would be a more 'expensive' search then ...
index=session_data sourcetype=salejandata | where match(_raw,"$mtcn$")
If the value for $mtcn$ is within a specific field, which already gets extracted, you could change the _raw for this field name.