How to format subsearch to give results with OR operator between and dropping field names.

[ankithreddy777]

I have a scenario where my subsearch should yield results in following format.
Index=index1 [search index=index2 earliest=10 days /table productId]

My productid valies are
ProductId= value1
ProductId=value2 etc

Should yeild
Index=index1 (value 1 ) OR (value2).....

May I know what is tbe best approach.How can I just return values

[kamlesh_vaghela]

Hi ankithreddy777,

Have you tried below search?

index=index1 [search index=index2 earliest=10d | dedup productId | return 10000 $productId]

Here I have used return command. For more info please check below URL.

https://docs.splunk.com/Documentation/Splunk/6.5.3/SearchReference/Return

I have used 10000 as head parameter to limit product Ids.

Thanks
Kamlesh

[rjthibod]

There are two ways: 1) let the subsearch simply return with a column of the productid field, or 2) use the format command to make the exact search string.

The first option is generally better, but there are some situations where the second option is needed.

First option: index=index1 [search index=index2 earliest=-10d@d | stats count by productId | fields + productid]

Second option: index=index1 [search index=index2 earliest=-10d@d | stats count by productId | fields productid | format]