I have a table that shows instances of errors from the event log over time by host.
I use a drop down that searches the event log data for Type="Error" | top limit=20 Message to populate $ErrorMessage$ with the value in the Message column. Then I have a table that uses $ErrorMessage$ and does this search:
Type="Error" Message ="$ErrorMessage$" | eval host=upper(host) | timechart count by host
The table and the drop down both default to 24 hour periods.
It works, except when the Message contains reserved characters, like [ or ]. Then I don't get any matches, even though results show in the drop down.
Do I need to escape characters in $ErrorMessage$ when I do my search for the timechart? If so, how do I do that without knowing what characters will show up or how many?
Drop Down search:
your_search | stats count values(host) as host by Message | sort 20 - count | nomv host | rex field=host mode=sed "s/(\S+)/host=\"\1\" OR /g" | eval searchquery=trim(host,"OR ")
Type="Error" $searchquery$" | eval host=upper(host) | timechart count by host