Hiya,
I swear I knew how to do this without macros, which seem like overkill, but I've lost it. Here's a simple example - define a field and expand that, so my search uses the value of that field:
eval hostname=server1| search host=%{hostname}
I've tried the usual shell and python syntax for variables as well as Splunk's token syntax , search host=$hostname$, but I'm getting zero results across the board, because it;s searching for the literal string. What do I need to do to expand that "hostname" variable/field? Thanks.
