Hey Everyone,
I am trying to search for a field to see how much a customer is spending but there is a letter in front of it.
e.g. "cost" : "C1000" showing they spent $1000.
So for example I want to search when the user spends between C1000 and C20000.
is there a way to remove the C and search the numbers of the result?
this is what I have so far
index="silverprod" source=*finance* ("Lambda" "Payload") NOT (lambda-warmer) *topup*
Can you please try this?
YOUR_SEARCH
| eval cost=replace(cost,"C","") | where cost >500 AND cost < 1500
My Sample Search :
|makeresults count=100 | eval a=100| accum a | eval cost="C".a
| rename comment as "Upto Now is sample data only"
| table cost
| eval cost=replace(cost,"C","") | where cost >500 AND cost < 1500
Thanks
KV
▄︻̷̿┻̿═━一 ?
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.