Home

Results 1 to 4 of 4

Thread: Search on VendorOutcomeCode (voc)

Threaded View

  1. #3
    Join Date
    Dec 2007
    Location
    Melbourne, Victoria, Australia
    Posts
    1,304

    Re: Search on VendorOutcomeCode (voc)

    Quote Originally Posted by ab View Post
    If you are in the main view where you can search for events, are you able
    to click 'Show More' (or whatever that link is) to see the whole event,
    and if so do you see the field there? If so, click on it and it will add
    that to the search for you.

    I want to say you can search on this, as I know I have created reports for
    clients based on things that came from that (e.g. HTTP 5xx or 4xx errors
    from Apache Tomcat, or AWS services, or whatever), but maybe I did the
    severity mapping in the collector and then built a search or report around
    that; if that's an option for you, it may work as well.

    Could you elaborate on what you're trying to find, and why? Have a
    screenshot of the events with that field which you can post somewhere, or
    an export of the event in text form (even better)?

    --
    Good luck.

    If you find this post helpful and are logged into the web interface,
    show your appreciation and click on the star below.

    If you want to send me a private message, please let me know in the
    forum as I do not use the web interface often.
    Code:
    (voc:"403")
    Works for me... also used to have correlations that worked with

    Code:
    (e.VendorOutcomeCode = "404")
    Sounds like the value you're searching for (in the period you're searching for), doesn't match actual values.

    voc doesn't show with an event's "more", only in "all" (which doesn't have filter-selectable items)....will not even show in "refine" fields....so have to use lucene query
    Last edited by ScorpionSting; 10-May-2019 at 12:18 AM.
    Visit my Website for links to Cool Solution articles.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •