Hi, how to a must write search then set fields from general search to subsearch?
Example:
 index=name host=thishost | eval ip=iphost+"\\" | eval counts=[ search index=name2 | where iphost=ip | return $iphost ]
Field  ip created in general search, how to use this field to subsearch?
How I must make it?
Thanks
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		Since subsearches execute before the main search, nothing created by the main search is available in the subsearch.
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		Since subsearches execute before the main search, nothing created by the main search is available in the subsearch.
