metadata and with pipe at the front of .... completely new command/structure for me, but it works, and works much faster But one more unexpected case has appeared due to this change. I cannot fi...
See more...
metadata and with pipe at the front of .... completely new command/structure for me, but it works, and works much faster But one more unexpected case has appeared due to this change. I cannot filter out rotated files which are in the directory and are not necessary . It looks something like file1.log file1.2024-09-01.log file1.2024-08-02.log etc. etc. and of course I only need the main , the most present file ( without any dates) so I tried | metadata type=sources where index=gwcc AND source !='*log.2024-*' | eval source2=lower(mvindex(split(source,".2024"),-1)) | eval file=lower(mvindex(split(source,"/"),-1)) | table source, source2, file but my "filter" does not work .