I need to search for a string composed of the month - year in Italian.
Example: "March-2021"
If I enter "March-2021" in the search, everything works but if I put the eval variable (month year) or the strcat variable (completo), it doesn't work.
I have :
|eval anno = strftime(_time,"%Y")
| eval mesi=strftime(_time,"%m")
| eval mese=case(
mesi="01","Gennaio-",
mesi="02","Febbraio-",
mesi="03","Marzo-",
mesi="04","Aprile-",
mesi="05","Maggio-",
mesi="06","giugno-",
mesi="07","Luglio-",
mesi="08","Agosto-",
mesi="09","Settembre-",
mesi="10","Ottobre-",
mesi="11","Novembre",
mesi="12","Dicembre-",
1=1, "INV")
|eval meseanno= mese.anno
|strcat mese anno completo
|search AMBITO = meseanno
so it doesn't work
if I use |search AMBITO = "March-2021" works
Can you help me understand how to look for a chained string?
Tks
Bye
Antonio
Try
|where AMBITO = meseanno
Thank you so much !!!!
but why didn't it work with search?
Basically, search works with strings, where works with fields.
Ah OK,
thanks for the explanation 🙂
But if two strings are concatenated, I expected search to work the same.
I expected search to work with string1.string2
I understand better the dynamics of splunk and how it works.
Thank you again.