I am trying to use a search to find fields that I want to use in another search as a table field.
The first search should return all fields that are used in a datamodel. This looks like this:
| datamodel "Authentication"
| spath output=foo path=objects{}
| spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName
| spath input=foo output=field path=fields{}.displayName
| eval fields = mvappend(calc_field , field)
| mvexpand fields
| table fields
Then I want to use the list of fields in the table command. I do this for the reason to be able to check the coverage of the CIM fields in the search. Unfortunately, so far without success, so I am grateful for all ideas and any kind of input.
My first guess was something like:
index="main" sourcetype="XmlWinEventLog" tag="authentication"
| table [
| datamodel "Authentication"
| spath output=foo path=objects{}
| spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName
| spath input=foo output=field path=fields{}.displayName
| eval fields = mvappend(calc_field , field)
| mvexpand fields
| format "" "" "," "" "" ""
| rex mode=sed field=search "s/fields=//g"
| rename search as table
]
Sorry, I missed a line
index="main" sourcetype="XmlWinEventLog" tag="authentication"
| table [
| datamodel "Authentication"
| spath output=foo path=objects{}
| spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName
| spath input=foo output=field path=fields{}.displayName
| eval query = mvappend(calc_field , field)
| fields query
| mvexpand query
| format "" "" "" "" "" ""
]
Try something like this:
index="main" sourcetype="XmlWinEventLog" tag="authentication"
| table [
| datamodel "Authentication"
| spath output=foo path=objects{}
| spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName
| spath input=foo output=field path=fields{}.displayName
| eval query = mvappend(calc_field , field)
| mvexpand query
| format "" "" "" "" "" ""
]
Hi @ITWhisperer , thanks for your reply. I already tried that one but get the following error:
Error in 'table' command: Invalid argument: 'calc_field=action'
Sorry, I missed a line
index="main" sourcetype="XmlWinEventLog" tag="authentication"
| table [
| datamodel "Authentication"
| spath output=foo path=objects{}
| spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName
| spath input=foo output=field path=fields{}.displayName
| eval query = mvappend(calc_field , field)
| fields query
| mvexpand query
| format "" "" "" "" "" ""
]