Firstly, with below search, there are events returned:
|from datamodel foo.fooo |search Counterparty=abc TransactionType=xyz
But with below "where", it does not return any events
|from datamodel foo.fooo |where Counterparty=abc AND TransactionType=xyz
I checked WHERE document and could not get a clue what went wrong. Could you help?
Can you try it like this:
|from datamodel foo.fooo |where Counterparty="abc" AND TransactionType="xyz"
|from datamodel foo.fooo | search Counterparty="abc" OR TransactionType="xyz"
This will give you the wrong results, because it is a OR
search.
Can you try it like this:
|from datamodel foo.fooo |where Counterparty="abc" AND TransactionType="xyz"
yes worked. Thanks. So where and eval require explicit indication of strings/numbers?
Yes, as @woodcock mentioned where
will use the right side of the =
as field names because it is eval
based. search
on the other side will treat as strings/numbers.
Feel free to accept this answer if it solved your problem ...
cheers, MuS
Otherwise it assumes that they are field names.