I have a table that shows instances of errors from the event log over time by host.
I use a drop down that searches the event log data for Type="Error" | top limit=20 Message to populate $ErrorMessage$ with the value in the Message column. Then I have a table that uses $ErrorMessage$ and does this search:
Type="Error" Message ="$ErrorMessage$" | eval host=upper(host) | timechart count by host
The table and the drop down both default to 24 hour periods.
It works, except when the Message contains reserved characters, like [ or ]. Then I don't get any matches, even though results show in the drop down.
Do I need to escape characters in $ErrorMessage$ when I do my search for the timechart? If so, how do I do that without knowing what characters will show up or how many?
... View more