We have one field as Customer=ABC DEF where one space in between where if i am giving any as Customer = *DEF* then its not giving any value..
hi @Susha,Provide string in double quotes.
| eval Customer="ABC DEF"
| search Customer="*DEF*"
thanks @manjunathmeti . but its not working since we have value as
where ABC keeps changing..
also i am getting below error :-
Error in 'makeresults' command: This command must be the first command of a search.