Hello, I hope someone can help.
I am attempting to do a subsearch that I am having difficulty with and hope someone here can assist.
I would like any fields in SourceB or SourceC that match SourceA, to be returned
I'd previously had the following syntax:
SourceA | table field1 | search [ | search SourceB table field1 ] | search [ |search SourceC field1 | table src]
but now, I need it to be interpreded more like this:
SourceA field1 (SourceB field1 or SourceC field1)
@Task1906
If you want to filter events from SourceA on the basis of field1 value from SourceB and SourceC then try this.
SourceA [ search SourceB | dedup field1 | fields field1 ] OR [ search SourceC | dedup field1 | fields field1] | join field1 [ search SourceC | dedup field1 | fields field1 src ]
Thanks
kamlesh_vaghela, thanks for the input, thanks to you I have it working. But SourceA is not needed where it is. #2 SourceC is listed twice, and the 2nd time should be SourceA if it is removed from the beginning.
The working command looks like this:
[ search SourceB | dedup field1
| fields field1]
OR
[ search SourceB | dedup field1 | fields field1]
| join field1
[ search SourceA | dedup field1 | fields field1]
| table field1 | dedup field1
@Task1906
If you want to filter events from SourceA on the basis of field1 value from SourceB and SourceC then try this.
SourceA [ search SourceB | dedup field1 | fields field1 ] OR [ search SourceC | dedup field1 | fields field1] | join field1 [ search SourceC | dedup field1 | fields field1 src ]
Thanks
you can use an inner join between source B/C and source A on field that needs to be matched.