How can append search result as part of another search result table from DensityFunction

masonlee2021 — Tue, 13 Jul 2021 22:37:12 GMT

Hi, there,

I am working on following search and somehow cannot append the search as part of the "fit DensityFunction" table result from search macro "search_macro_smart($cef_ruleid$)"

The search macro "search_macro_smart($cef_ruleid$)" will be generate 85 raw of data for outlier with data in past 45 days and I need the append "cef_ruleid " as part of the search macro output on dashboard so we can know the detected outlier belong to which ""cef_ruleid "

Your help is appreciated,

mason

topic How can append search result as part of another search result table from DensityFunction in Splunk Search

How can append search result as part of another search result table from DensityFunction