Doing lookup in the same index without using lookup command

[thambisetty]

Hi
[index=main host=syslog status="deny"| top src_IP | table src_IP ]:::::this is my sub search.
and it will produce top 10 src_IPs like below.
10.0.0.0

10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4
10.0.0.5
10.0.0.6
10.0.0.7
10.0.0.8
10.0.0.9
Now I want to check the status where status="start" OR status="accept" for the above src_IPs in the same index and host.

Please help me in this..
Thanks in advance.

[somesoni2 · Accepted solution]

Try this

index=main host=syslog status="start" OR status="accept" [search index=main host=syslog status="deny"| top src_IP | table src_IP | format "" "" "" "" "OR" ""]

[thambisetty]

Thank u soooo much. it worked.

[somesoni2]

This will create a consolidated single statement from results of subsearch (something like src_IP=value1 OR src_IP=value2...etc. Ideally previous version of the search should've worked but something adding format does the trick.

[thambisetty]

Thanks.
Im not in office.
may I know why that format..

[somesoni2]

Try the updated one.

[thambisetty]

Thanks for ur immediate response.
I tried that one but it is showing different src_IPs. The src_IPs not at all related to result of sub search.