|stats count|eval cip='foo'|map search="search index=* Address=$cip$"
It errors out saying "Error in 'map': Did not find value for required attribute 'cip'."
Hi wkupersa,
use it like this:
|stats count|eval cip="foo"|map search="search index=* Address=$cip$"
This will set the value of cip
to be foo
. In your original search you did set the value of cip
to be the value of the field called foo
.
Hope this helps ...
cheers, MuS
Hi wkupersa,
use it like this:
|stats count|eval cip="foo"|map search="search index=* Address=$cip$"
This will set the value of cip
to be foo
. In your original search you did set the value of cip
to be the value of the field called foo
.
Hope this helps ...
cheers, MuS
Geez. Single quotes versus double. Feeling brain dead. Thanks!
you're welcome 🙂