Hi,
It seems I cannot get any search results without including a wildcard in messagetype.
More specifically:
After searching for messagetype="proposal" , no events are shown.
Searching for messagetype="*proposal" , events are shown.
Further research also showed that there aren't any special characters involved in the problem.
This is the complete query:
index="*-closecl-*" application="closecl" component="closecl-bfl-ws"
environment=*
transactionType="notifyParty" messageType="*proposal" | dedup TranID sortby +_time| lookup CloseCLDossierMetaData uid as TranID OUTPUTNEW uid CustomerCode, ProductType, GrossCreditAmount, LabelCode, ProductCode, SourceSystem | timechart minspan=1d bins=60 dc(TranID) as count | fillnull
Thanks in advance!
updated by dmj to mark code
... View more