I'm trying to create a new field called TYPE, which is dependent on the word "summary" or "detail" appearing in the TITLE field, so I can then count by TYPE.
I successfully filtered my logs to identify reports with "summary" or "detail" in the title:
|search(title="*summary*" OR "*detail*")
Then, I tried to create TYPE and set its output values to "Report Summary" or "Detailed Report":
|eval type=if(match(title,"*summary*"), "Report Summary", match(title, "*detail*"), "Detailed Report")
I also tried doing a field extraction, but the title field does not appear in the Select Fields box to be highlighted.
I'm stuck. Please help!
... View more