Map search

[BhuvanM]

Hi,

I am using below query to search all correlation ID based on a search string and get the SOAPResponse using map search, But this is returning a partial search results. Is my query looks good ?

index=pivotal sourcetype=ApplicationTest "SearchString" CorrelationId="*" | table CorrelationId | map search="search index=pivotal sourcetype=ApplicationTest $CorrelationId$ SOAPResponse"

Thanks, Bhuvan.

[ITWhisperer]

Try something like:

index=pivotal sourcetype=ApplicationTest ("SearchString" OR "SOAPResponse") CorrelationId="*"
| stats values(*) as * by CorrelationId
| search "SearchString"