i have index=main user=Local Domain\abc it wont search any result but if i search with index=main user=Local Domain\\abc it works,
i tried rex as well but it didnt work for my dashboard as it wont display any search, any solution to search without adding another \ to the search
Have you tried this?
index=main user="Local Domain\abc"
yes. I tried that too, but the search is happening for
index=main user="Local Domain\\abc"
which i tried to regex but it didnt display on dashboard but i can see the new field being created with. from dashboard i wanted to send the selected as token to get stats.