use eval variable in my search

[gpSplunk123]

hi, i'm trying to use an eval variable in my search. i've tried many different things and i've failed, and i'm sure this is a quick easy solution but i just can't seem to get it.  my eval variables print out exactly as i need, i have validated it with the table as well as manually put it in the search as well.

| eval z="legolas,TGZ,ux*"
| eval name="*" + mvindex(split(z, ","), 0) + "*"
| eval type=mvindex(split(z, ","), 1)
| eval query="*" + mvindex(split(z, ","), 2)
| eval searchVar=if(type="JAR", name, query)
| table name, type, query, searchVar
| search artifactory=* uri=searchVar

[richgalloway]

The search command doesn't support field names on the right side of an expression.  Try where, instead.  Also, the table command stripped out the artifactory field so the search will never find a match.

| eval z="legolas,TGZ,ux*"
| eval name="*" + mvindex(split(z, ","), 0) + "*"
| eval type=mvindex(split(z, ","), 1)
| eval query="*" + mvindex(split(z, ","), 2)
| eval searchVar=if(type="JAR", name, query)
| where (match(artifactory, ".*") AND uri=searchVar)

[gpSplunk123]

it didn't work for me, it still gave me 0 results found.  Replacing the search with the where clause.

[richgalloway]

Did you also remove the table command?