Using variable

[jimjohn]

My search string is
(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
Can I have a common varible in place of inputString.

I tried using using eval like below.
eval inupt=inputString|(host=ABC AND "Emp Code"=inputString) OR (host=joinHost AND "EMPLOYER_CODE"=inputString)
But not getting result.

Any help

[kristian_kolb]

No, not the way you describe it.

You cannot start with an eval that way. You might get away with something like;

host=ABC OR host=joinHost inputString | blah blah blah

Which will search through the events for inputString, regardless of whether it appears in a field or not. But since inputString is treated as a literal string, rather than a field value, your search may return results where inputString is present in other parts of the event.

/k