Use results from one search in another query

New Member

How do I take the results of one query and use it in another. I want to take the results of trackedsessions and use it in the tile query. (i.e. tile/trackedsessions)

tracked sessions:
| eval View=case(like(publishId,"%U"),"unsubscribed",like(publishId,"%S"),"subscribed")
| transaction startswith="Enter" endswith="Timeout" or "Exit" by deviceID View
| table View deviceID eventcount

| stats count(deviceID) as count by View

| stats count(tile) as tile, count as trackedsessions
| eval percentage=round((tile/trackedsessions*100),2)

Tags (1)
0 Karma


Hi dwong2,

there are multiple options for this problem, but it is hard to provide the one solution that works best for you without more details.

So, lets start with using a sub search: Use the search that returns the least results in the sub search, this is because sub searches have some limits that can bight you .

A simple example would be :

 index=2 [ search index=1 | fields SomeFieldYouWant | format ] 

That will search index=2 for a single result found in index=1

The next level is to use return with a sub search:

 index=2 [ search index=1 | fields SomeFieldYouWant | return ] 

That will search index=2 for a list of OR results found in index=1

The much better option is to ignore all kinds of sub searches, joins, appends, transactions at all and just use stats ; Read more about the stats approach here or here the March 2016 session of @sideview

Hope this helps ...

cheers, MuS