It looks like you have your fields in the wrong order in the mvmap and possible your filter logic has been inverted. Try something like this | makeresults count=10
| eval string=mvindex(split("abc",...
See more...
It looks like you have your fields in the wrong order in the mvmap and possible your filter logic has been inverted. Try something like this | makeresults count=10
| eval string=mvindex(split("abc",""),random()%3).mvindex(split("abc",""),random()%3).mvindex(split("abc",""),random()%3)
| eval regex="abc|cba"
| eval regex=split(regex,"|")
| eval true=mvmap(regex,if(match(string,regex),regex,0))
| eval true=mvfilter(NOT true=0)
| where isnotnull(true) If the random string is abc or cba you will get a result, if not, you won't