$DATE is getting displayed on logcompare
I m doing logcompare on our logs.Upon doing logcompare getting $DATE in the result which is annoying.One more thing i want to know whether we can do log compare in individual field.
Suppose we have _raw={"timestamp":"11111","message":"hi","level":"error"}
i want to do logcompare on message field.How to do this?
Please sign in to leave a comment.
Comments
1 comment