I am trying to add a new field in my events using eval, but I am getting errors.
My search looks like this:
... | eval newField=`getIpBasedOnMac($mac$)` | chart values(field1) over newField by mac
Any suggestions on how I could create newField and give it the value that the macro returns?
