Display the timestamp from both the main search AND the subsearch (multiple-fields)

[pkeller]

Trying to add some additional information in the output of an event correlation

index=compute source="*messages" "DOWN" AND [search index=storage source="*messages" ERROR_STRING | rename _time as Storage_Event_Time | rename Client AS host| fields host, Storage_Event_Time ] | table Storage_Event_TIme,_time,host

This correlation works fine WITHOUT trying to add the Storage_Event_Time field to the 'fields' portion of the subsearch ... ( I get the blue bar saying "no matching fields exist" ) ...

I can even run the entire search without error if I just remove "Storage_Event_Time from the 'table' command ... I'm inclined to believe that I can only pass a single field ( and a common one at that ) out of the subsearch ...

Apologies if this is not clear.

[sowings · Accepted solution]

The subsearch in your current syntax is returning rows to act as an event filter to your outer search.

If you click the job inspector (the white-on-blue 'i' on the right), you'll see a blob that says "subsearch evaluated to", and it'll be something like "( (host="<host1> AND Storage_Event_Time=time_1) OR (host="<host2" AND Storage_Event_Time=time_2) )". If the field "Storage_Event_Time" doesn't exist in the compute index, you won't return any results.

Perhaps you want to append?

[sowings]

Ah, I see. Append is just that, take this second set, add it to (the "bottom") of the first set. It sounds instead like you might want to be doing join on the two, using host as the common column.

[pkeller]

Thank you ... Your answer makes complete sense ... I'm working on getting this to work using append, but still having issues getting the search in the append section to associate with the prior search ... So, in essence, I get results that do not fold in the results from the append ... ie: half the results are from the first part of the search and the other half are from the append ... but they're not matching on the 'host' field ...

It probably sounds wonky .. .I know ... I'll keep thunking away.