I have two tables that are generated out of queries as below:
Search1:
eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") | transaction ID keepevicted=t | table _time, ID, Error, S1, A1
Search2:
eventtype="Myown" source="*File2*" | dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | transaction ID keepevicted=t | table _time, ID, Error, S2
These two searches generate tables and behave as expected.
Next I am combining them into one using append as below:
eventtype="Myown" source="*File1*" | dedup ID| eval A1=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg | eval S1=if(A1="Pass", "Pass", "Fail") | append [search eventtype="Myown" source="*File2*" | dedup ID | eval S2=if(len(emsg)>0, "Fail", "Pass") | eval Error=emsg] | transaction ID keepevicted=t | table _time, ID, Error, S2
The table comes up correctly and the values are shown properly.
When I click on any cell, that provides me drill down to the log entry properly.
However, at this point when I click Actions and show source, it is throwing an error and does not display the source.
any suggestions?
What error are you getting? You cannot see source
when you use transaction
. Remove the transaction
command. You should still get the desired results. But, again, I think you will get an error when you click on the row generated by the sub-search.