I want to know if it's possible to use an index with loadjob result.
I have some values inside a loadjob and I try to use it within a search on an index.
My loadjob results will be considered as values to filter the index content.
I tried to use "append" or "join" like this, but it doesn't work:
index=my_index_A | fields ip_address locate_ip |append [|loadjob info_sid |fields ip_address ] | table ip_address locate_ip
Do you have any idea?
hi somesoni2, i tried your solution but not work and finally a solved it by
index=my_index_A [| loadjob info_sid | stats count by ip_address | return $ip_address] | table ip_address locate_ip
View solution in original post
Try something like this
index=my_index_A [| loadjob info_sid | stats count by ip_address | table ip_address] | table ip_address locate_ip
This will add the ip_address field coming from the loadjob, as filter in the base search.