Problem in report part?

[Shan]

I'm generating a transaction report with the help of query mentioned below.

index=session_data sourcetype=salejandata "$mtcn$"
| eval TXN_status = if(isnotnull(Error),"Error","Success")
| table CardNo CardDeatail TXN_status Success Failure Total_Txn

i'm passing mtcn as dynamic value from report or dashboard.
mtcn values may be 10 or 16 digit number.

User can only provide 10 digit mtcn number while accessing report or dashboard.
But in logs where query is searching for data, there it will be 16 digit value.

Example:

user may provide mtcn number as 2342567895 in text box of Report or Dashboard.

but in log file that mtcn may be prefixed or suffixed as mentioned below.

2342567895HD3567

DER4RR2342567895

G4523425678956KK

I thought it must be working. what i did is i prefixed and suffixed mtcn token with * as mentioned "$mtcn$".
But its not working as expected.
please guide me how to achieve it.
Thanks in advance.

Shankarananth

[DMohn]

You could use a match here, but this would be a more 'expensive' search then ...

Try:

 index=session_data sourcetype=salejandata | where match(_raw,"$mtcn$")

If the value for $mtcn$ is within a specific field, which already gets extracted, you could change the _raw for this field name.