I have a piece of code as -
| rex field=$AppNC$ ".*\/(?<ChosenAppCode>.*"
| search job_name=* U_APP_CODE=ChosenAppCode
From the drop down the AppNC (App Name Code) is chosen and the search should have the app code part.
How can the following be dynamic ?
U_APP_CODE=ChosenAppCode
Meaning, ChosenAppCode, would be the code extracted in the line above?
rex will work on fields not tokens, so eval a field to the token and rex that or create an extra token in the change handler of the dropdown to have the part of the token you want for your search (using a where command as @bowesmana suggested)
Thank you both, it's working now.
@danielbb - Please consider accepting the answer which helped you!!
rex will work on fields not tokens, so eval a field to the token and rex that or create an extra token in the change handler of the dropdown to have the part of the token you want for your search (using a where command as @bowesmana suggested)
Instead of using search command, where you can't search for a field value, use where, e.g.
| where match(job_name, ".*") AND U_APP_CODE=ChosenAppCode
Note that if you use where, then you need to use match() command for wildcard matching and that uses regex. Depending on how you are searching for job_name, you could do both search and where.