Could you please let me know how to use an evaluated field in search command
| eval field1="search-val1|search-val2"
| eval searchval=mvindex(split(field1,"|"),1)
| search "*search-val2*"
I am trying to create a dashboard with one of the search as above. I get the field1 value from dropdown list in dashboard. Something like
| eval field1 = $searchkey$
The above works with the static value in search command but I am trying to use searchval field in search command like
| search 'searchval'
Can someone help? Thanks for the help.
what if i use "where" command to set the source. does it impact the performance?
Example using #2 instead of #1
1. index=main sourcetype="access_combined" source="app1"
2. index=main sourcetype="access_combined" | where match(source,"app1")
This will affect performance mainly because the first search in #2 will return more events than that in #1.
As a side, if source is precisely "app1", do not use match(). Just say | where source=="app1". A callout to a function adds to memory and compute; and match() is a regex function, adds even more compute.
sorry - that is not working.
Basically, I need to execute command like this
index=main sourcetype="access_combined" "*search-val2*"
where "search-val2" get evaluate from pipe(|) separated string
Do the separation in the makeresults subsearch
| search [| makeresults | fields - _time | eval field1 = $searchval$ | eval query=mvindex(split(field1,"|"),1) | fields query]