topic Re: Subsearch in Dashboards & Visualizations

Subsearch: How to create a search which returns multiple values?

madhukar3us — Tue, 28 Jun 2022 17:43:11 GMT

Hi,

I have a search query which returns multiple values. For example, the search query returns abc, def, ghi.

I need to take this as input and i need to perform a search of these values. The logs contains the abc-123-678, def-678+943 , ghi-678-123 and i need to search the events that contains these strings.

Any suggestions?

Re: Subsearch

danielcj — Tue, 28 Jun 2022 17:23:24 GMT

Hello @madhukar3us ,

Could you please provide more information? Are these values on the same field? Could you also share some log samples?

Thanks.

Re: Subsearch

gcusello — Tue, 28 Jun 2022 17:25:48 GMT

Hi @madhukar3us ,

if you need to use the result of a subquery to search as text in the main search, you have to follow this approach

supposing that the field in the subsearch containing the values to search is "my_field"

your_main_search [ search your_secondary_search rename my_field AS query | fields query ]

Ciao.

Giuseppe

Re: Subsearch: How to create a search which returns multiple values?

marysan — Wed, 29 Jun 2022 06:57:54 GMT

Hi
I suppose that you need join command for example :
index=index1 abc=123-678 def=678+943 , ghi=678-123
| fields abc,def,ghi
| join type=inner abc,def,ghi
[| search index=index2]