20 Mar 2024 08:14 PM - last edited on 21 Mar 2024 10:30 AM by MaciejNeumann
Here are two queries, I don't understand why the results are different (same time period 24 hours):
fetch logs
| filter matchesPhrase(host.name, "tar04*")
| summarize collectDistinct(host.name)
tar045.dcmax.local
tar046.dcmax.local
fetch logs
| filter matchesValue(host.name, "tar04*")
| summarize collectDistinct(host.name)
tar040.dcmax.local
tar041.dcmax.local
tar045.dcmax.local
tar046.dcmax.local
Solved! Go to Solution.
20 Mar 2024 08:39 PM - edited 20 Mar 2024 08:40 PM
Hi @GerryIsHere
The only difference between those functions are the validations that matchesPhrase realizes.
Tried to replicate your scenario with the same data, and in both cases the result is the same.
Could you get us more context?
Regards,
20 Mar 2024 08:44 PM
the logs are from WebLogic servers, I think there is 1-2 million logs a day. If I run the queries just counting the number of logs matchesPhrase finds way fewer logs. The host.names are exactly as shown.
20 Mar 2024 08:45 PM
doesn't support mid-string wildcards, except some of the time when it does apparently!