hello
I have a strange behavior with an eval command
if I am doing this it works well
| eval site=case(site=="0", "AA", site=="BR", "BB", site=="PER", "CC", 1==1,site)
| eval s=lower(s...
See more...
hello
I have a strange behavior with an eval command
if I am doing this it works well
| eval site=case(site=="0", "AA", site=="BR", "BB", site=="PER", "CC", 1==1,site)
| eval s=lower(s)
|search site="$site$"
but if I put | search site="$site$" just after the eval, the search command is not recognized as a splunk command!
| eval site=case(site=="0", "AA", site=="BR", "BB", site=="PER", "CC", 1==1,site)
|search site="$site$"
what is wrong please?