I'm getting from my dashboard parameter with '_' value in it, I would like to start my search by evaluating a new parameter without the '_' and then use it in my search. In Addition, I would like to inject this parameter into my regex and do another manipulation on my result. This is my query: index=* |eval temp = ("my_value","_","")| "ERROR" "Exception in script execution" "at scripts.$temp$." [search index=* script_name=my_value tid=* | head 1 | return tid] | rex "at\sscripts.$temp$.(?<stack_trace>[^\t\n\s]+)" | head 1 | table stack_trace I would like it to be searched like that: index=* |eval temp = ("my_value","_","")| "ERROR" "Exception in script execution" "at scripts.myvalue." [search index=* script_name=my_value tid=* | head 1 | return tid] | rex "at\sscripts.myvalue.(?<stack_trace>[^\t\n\s]+)" | head 1 | table stack_trace I can't seem to figure it out, could somebody help me? Thanks:)
... View more