Hi, there,
I am working on following search and somehow cannot append the search as part of the "fit DensityFunction" table result from search macro "search_macro_smart($cef_ruleid$)"
splunk_server="splunk" index="area" source="area1" sourcetype="dsystem_events"
| stats count by cef_ruleid
| sort - count
| head 85
| map search="search `search_macro_smart($cef_ruleid$)`" maxsearches=85
| join [| makeresults | eval current_id=$cef_ruleid$ | stats values(current_id)]
The search macro "search_macro_smart($cef_ruleid$)" will be generate 85 raw of data for outlier with data in past 45 days and I need the append "cef_ruleid " as part of the search macro output on dashboard so we can know the detected outlier belong to which ""cef_ruleid "
Your help is appreciated,
mason
