Splunk Search

search query

aokhovat
New Member

Splunk new-bee here. Let's say I have two records in the log file: one record has " myID=1234 ticker= abc" and the other record does not have the "ticker" field but only "myID" tag as in " myID=1234" . How can a search based on ticker=abc pick up these two records? Note the second record does not have "ticker" and search is based on ticker=abc. Thanks

Tags (1)
0 Karma

Vijeta
Influencer

@aokhovat you can do
|eventstats values(ticket) as ticker by myID| search ticker=abc