Field extraction for space

Susha · ‎08-10-2021

Hi Team,

We have one field as Customer=ABC DEF where one space in between where if i am giving any as Customer = *DEF* then its not giving any value..

manjunathmeti · ‎08-10-2021

hi @Susha,

Provide string in double quotes.

| makeresults 
| eval Customer="ABC DEF" 
| search Customer="*DEF*"

Susha · ‎08-10-2021

thanks @manjunathmeti . but its not working since we have value as

Customer="ABC DEF"

where ABC keeps changing..

also i am getting below error :-

Error in 'makeresults' command: This command must be the first command of a search.