Is there a way to restrict this search with upper case and lower case scenarios?
index=aap_prod sourcetype="HDP:PROD:OOZIE"
(":start:] with user-retry state" OR "@end***]Action updated in DB!")
When I use this @end***
, it also returns results with END_IMPORT***
, which is an event detail for failed jobs.
Two different search scenarios
Hi , you can try something like
index=aap_prod sourcetype="HDP:PROD:OOZIE" (":start:] with user-retry state" OR CASE(@end***]Action updated in DB))