I am using eval foo = mvcount(split(field,"")) to count the number of characters in a field at search time. Is there a place to put such a statement so that the field foo gets created for all events that contain that field?
Thanks
I am using eval foo = mvcount(split(field,"")) to count the number of characters in a field at search time. Is there a place to put such a statement so that the field foo gets created for all events that contain that field?
Thanks