Hello Splunkers -
I am trying to filter any value that is wrapped in $, such as $host$or $value$. I thought the below would work, but it is not. Can someone point out what I am doing wrong? Thanks!
| eval dollar_sign=if(host_value=="$host$" OR host_value=="$value$", "yes", "no")
| search NOT dollar_sign=yes
If you are using this in a dashboard, the dollar signs have to be doubled up otherwise it is looking for tokens
| eval dollar_sign=if(host_value=="$$host$$" OR host_value=="$$value$$", "yes", "no")
| search NOT dollar_sign=yes
I will keep this in mind if I end up using this in a dashboard. Thank you @ITWhisperer
| eval dollar_sign=IF(LIKE(host_value, "$%$"), "yes", "no")
This solved my use case. Thank you @johnhuang