Hello, I'm trying to filter my events/results after evalulating the field name and value dynamically using eval.
index=XXXX YYYYYYY | eval field_name=PPPP | eval field_value=KKKK | search field_name=field_value
I tried below options, but none worked.
index=XXXX [|gentimes start=-1 | eval space="Test"| table space]
index=XXXX [|gentimes start=-1 | eval space="Test"| fields space]
I am not entirely clear what it is you are trying to do - does this help?
index=XXXX YYYYYYY | where PPPP="KKKK"
I need to evalute some search criteria based on the inputs selected and peform the search.
Please explain your usecase in a bit more detail