A recent change to logs has broken my dashboard panels and reporting. I'm struggling to find the best way to modify my search criteria to pick up data prior to the change and after. It's a very simple change as single quotation marks were added around the field but it's giving me a big headache.
index=prd sourcetype=core Step=* Time=* | timechart avg(Time) by Step span=1d
Field in event log changed:
FROM: Step=CONVERSION_APPLICATION
TO: Step='CONVERSION_APPLICATION' (with single quotation marks)
Strip the quotes with the trim function.
index=prd sourcetype=core Step=* Time=*
| eval Step=trim(Step, "'")
| timechart avg(Time) by Step span=1d
That worked. Thank you very much!!
Strip the quotes with the trim function.
index=prd sourcetype=core Step=* Time=*
| eval Step=trim(Step, "'")
| timechart avg(Time) by Step span=1d