*I would typically use the map command for this, but it's currently broken and support is working to fix it
That being said, I'm trying to take a value from search1, pass it to search2 , grab a field from that 2nd search, and also pass that to 3rd search. Hopefully one of you lovely people can point me in the right direction.
IE:
index=foo | rex field field1
index=boo field2=$field1$ | table src_ip
index=bar src_ip=$src_ip$ | stats values(domain) etc etc
Any help on this would be supremely appreciated
It looks like subsearches may do the job.
index=bar
[ index=boo
[index=foo | rex field field1 | rename field1 as field2 | format]
| return src_ip ]
| stats values(domain) etc etc
index=foo OR index=boo OR index=bar | rex field field2|eventstats dc(index) as flag1 by field2 | stats values(domain) etc etc dc(index) as flag values(flag1) as flag1 by src_ip |where flag1=2 AND flag > 1
It looks like subsearches may do the job.
index=bar
[ index=boo
[index=foo | rex field field1 | rename field1 as field2 | format]
| return src_ip ]
| stats values(domain) etc etc