I have a scenario where my subsearch should yield results in following format.
Index=index1 [search index=index2 earliest=10 days /table productId]
My productid valies are
ProductId= value1
ProductId=value2 etc
Should yeild
Index=index1 (value 1 ) OR (value2).....
May I know what is tbe best approach.How can I just return values
Hi ankithreddy777,
Have you tried below search?
index=index1 [search index=index2 earliest=10d | dedup productId | return 10000 $productId]
Here I have used return command. For more info please check below URL.
https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Return
I have used 10000 as head parameter to limit product Ids.
Thanks
Kamlesh
There are two ways: 1) let the subsearch simply return with a column of the productid
field, or 2) use the format
command to make the exact search string.
The first option is generally better, but there are some situations where the second option is needed.
First option: index=index1 [search index=index2 earliest=-10d@d | stats count by productId | fields + productid]
Second option: index=index1 [search index=index2 earliest=-10d@d | stats count by productId | fields productid | format]