How do I edit my search on usernames to also table associated passwords?

[mohanmk1905]

I am getting Username and User id Fields while search using username, then I pipe it and search user ID to get the password. How to put them in a table TABLE USERNAME USERID PASSWORD like this.

index!=_internal "USERNAME" | TABLE USERNAME USERID | SEARCH index!=_internal "$USERID$" | TABLE USERNAME USERID PASSWORD

The search above is not working.

[mohanmk1905]

Sorry i didn't convey my question correctly.- This is not an exact scenario but i am trying to make a similar scenario.

Let me explain it clearly.

After First search - i am able to take USERNAME AND USERID in a table.

First search : index = something "USERNAME" | table USERNAME USERID

Second search - i am searching all the USERID feilds taken in first search and taking password in the second search for that userid . so i am take USERID and PASSWORD table here.

index = something "USERNAME" | Index = something "$USERID$" | TABLE USERID PASSWORD

i am able to join two searches using join

index = something "USERNAME" | table USERNAME USERID | join USERID [SEARCH index = something "USERNAME" | Index = something "$USERID$" | TABLE USERID PASSWORD ] | table USERNAME USERID PASSWORD.

But i feel like i am using the same search (index = something "USERNAME" ) twice in the join scenario.
Please how to get that three feild in one search itself

[inventsekar]

Hi mohanmk,
Please check this one -

index!=_internal "USERNAME" OR "$USERID$" | TABLE USERNAME USERID PASSWORD

[gcusello]

Hi mohanmk1905,
After a table command, the only fields you have are the ones you listed in table: in your example you haven't PASSWORD field in the first table, so, in the following pipes you haven't PASSWORD field, but only USERNAME and USERID.

Every way it's strange the way you have to build your search:

• why do you use index!=_internal? if you use index=* you have the same result!
• if you can, try to express indexes in your search (index=main OR index=web...): it's more efficient;
• why do you use fields search in two points? it's more efficient to have only one search as first as possible;
• I think that "USERNAME" is a word and not a field, if it's a field you have to insert in your search USERNAME="$USERNAME$" or a value.

Probably your search is better like something:

index=* "USERNAME" "$USERID$" | TABLE USERNAME USERID PASSWORD

Bye.
Giuseppe

[mohanmk1905]

sorry sir i conveyed my question correctly now

[gcusello]

Hi mohanmk1905,
every way the problem is the same: if you haven't password field in the first table command, you haven't it in the second one, try the search I suggested: the output of a command on the left of the pipe "|" is the input for the command on the right of the pipe "|".
bye.
Giuseppe