topic Re: Is it possible to use an index with a loadjob result to filter content? in Getting Data In

Is it possible to use an index with a loadjob result to filter content?

sfatnass — Tue, 28 Jul 2015 09:45:54 GMT

Hii everybody,

I want to know if it's possible to use an index with loadjob result.

I have some values inside a loadjob and I try to use it within a search on an index.
My loadjob results will be considered as values to filter the index content.

I tried to use "append" or "join" like this, but it doesn't work:

index=my_index_A  | fields ip_address locate_ip |append [|loadjob info_sid |fields ip_address ] | table ip_address locate_ip

Do you have any idea?
thx

Re: Is it possible to use an index with a loadjob result to filter content?

somesoni2 — Tue, 28 Jul 2015 15:06:07 GMT

Try something like this

index=my_index_A [| loadjob info_sid | stats count by ip_address | table ip_address] | table ip_address locate_ip

This will add the ip_address field coming from the loadjob, as filter in the base search.

Re: Is it possible to use an index with a loadjob result to filter content?

sfatnass — Tue, 29 Sep 2020 06:50:43 GMT

hi somesoni2, i tried your solution but not work and finally a solved it by

return $ip_address

index=my_index_A [| loadjob info_sid | stats count by ip_address | return $ip_address] | table ip_address locate_ip