How to filter the results based on the evaluated field?

[amerineni]

I'm trying the below query,

index=XXXXXXXXX   | eval space="cf_space_name=production" | search "space"  YYYYYYYYYYYY | stats count

===================================================================

I want to filter the results based on the evaluated field.

| search "space"    XXXXXXXXXXXXX    => is not returning correct values

|  search "cf_space_name=production"    XXXXXXXXXXXXX    =>  but If I use the value like this its working.

how to fix this? Thanks for the help.

[yuanliu]

Like @richgalloway mentioned, the value in 'space' is not substituted as part of command in | search.  Can you explain why it is even necessary to use that syntax if  | search "cf_space_name=production" YYYYYYYYYYY already works?  Maybe you are thinking of a token in dashboard?

(As a side, | search "cf_space_name=production" YYYYYYYYYYY  is semantically different from | search cf_space_name=production YYYYYYYYYYY.  You want to consider what exactly is intended.)

[amerineni]

I have two inputs in the dashboard and I need to evaluate filed name and value to compare dynamically based on those inputs and filter events based on that.  That is what I'm tryign to do.

[yuanliu]

I still don't see how "cf_space_name=production" is a dynamic input.  In this form, it is just a static string.  Can you explain?  Maybe you can illustrate with data (anonymize as necessary)?

[richgalloway]

I hoping this was in a dashboard.  If you have an input called "space" that holds a cf_space_name value then you can reference that token in the SPL.

index=XXXXXXXXX cf_space_name=$space$ YYYYYYYYYYYY 
| stats count

[richgalloway]

The search command treats "space" with or without quotation marks as a literal string rather than a field name. 

The eval command assigns a value to a field, creating the field if necessary.  It does not define variables that can be used in arbitrary places.

To search for specific text in an event, put that text in a search command.