How to use action="blocked" on search bar ?

[Nasser]

I have file.csv and I want to do an action, action="blocked" but it appears to me there is no result after searching so is there any a way to help me?

[ghaidaqader]

Hi Nasser I am taking the same course I tried multiple queries nothing worked can you help me

source="3--المصدر-الداعم-الثالثسجل-الملفات.csv" host="Ghaidas-MBP" index="main" sourcetype="stc_logs" action="blocked"     

I used this Query as well to count action 

source="3--المصدر-الداعم-الثالثسجل-الملفات.csv" host="Ghaidas-MBP" index="main" sourcetype="stc_logs" | stats count by action

but neither queries have yielded any results 

[Nasser]

try this

booleans operators must be used in UPPERCASE, in addition the AND operator is mandatory only in eval.

This means that you're searching using as additional conditions: action="blocked" and the word "and".

Ciao.

[abdullahR]

hello Nasser can you help me on this?

[Nasser]

Thanks a lot it helped me

[gcusello · Accepted solution]

Hi @Nasser,

booleans operators must be used in UPPERCASE, in addition the AND operator is mandatory only in eval.

This means that you're searching using as additional conditions: action="blocked" and the word "and".

Ciao.

Giuseppe