Any way of achieving this:
| makeresults
| eval Column1="MyData"
| eval TestField="Column1"
| eval Result{TestField}=if('{TestField}'="MyData",1,0)
The reason is simple. I want to define a lookup with all the fieldnames (columns) that is required for a specific category of events.
My current search is larger than this, but i have found this example to describe my problem the best. if i solve this i can solve the rest. The result should be that ResultColumn1 = 1
{TestField} works on the left side of = but not on the right side in the eval.
I tried every combination of TestField including (',",$,$$,<<) but i am not able to retrieve the data from the field which is defined in TestField.
If i use {TestField} on the right side of = i get an error. This is why i have put '{TestField}' in my example above.
I am using Enterprise 7.0.1
Any help is appreciated.
... View more