Hello,
we have index "text-index"
and region is passed as meta
_meta = region::east
sourcetype = testlogs
when i query
index="text-index" sourcetype=testlogs
i see all the logs displayed.
when i use index="text-index" sourcetype=testlogs region="*" i see all the logs displayed
but when i use index="text-index" sourcetype=testlogs region="east" it will display the logs only which has word east. its supposed list all the like other two queries above. why does it gives me only if words match. please correct me if i'm doing anything wrong
... View more