I have two specific search strings I use to narrow down my search in the format of: index=someIndex "searchtermA" OR "searchTermB" | .... I want to be able to chart the two values (as their own unique counts in one chart) however field extraction has proven to have too many problems with making field extractions for these two search terms. They are not events or sources or sourcetypes either.
So I've been trying to see if eval could somehow make a sort of token and set it to this search term so it can be used by chart/stats/etc.
Any help would be greatly appreciated!
I'm not sure what you're trying to do will work.
How about we try to fix you original problem of field extractions? Tell us more about that and maybe we can suggest a fix or a better workaround.