Instance_ID is one extracted field in code *
. If there is a value in the $ID$
field, then result should list only for that value, else as default, it should display results for all values (for all values, I am trying *
to tmp)
Code *|eval tmp="$ID$" | eval tmp=if(isnull(tmp),"*",tmp |search Instance_ID = tmp
The error is telling you that you are missing an end parenthesis in your eval
command. So, just add one in, like this:
Code *|eval tmp="$ID$" | eval tmp=if(isnull(tmp),"*",tmp) |search Instance_ID = tmp
The error is telling you that you are missing an end parenthesis in your eval
command. So, just add one in, like this:
Code *|eval tmp="$ID$" | eval tmp=if(isnull(tmp),"*",tmp) |search Instance_ID = tmp
There seems to be a typo in your code and you need to use "where" instead of "search" when comparing fields:
Code |eval tmp="$ID$" | eval tmp=if(isnull(tmp),"",tmp) | where Instance_ID = tmp
You can also use the match operator. See this post