I have an
```
index=xyz data.id=1
```
which gives me list of unique id's [1,2,3,4,5]Not sure how to store the above result to get it used for another query.
| stats count by uniqueId
Now I want to use the list above and get the data from another query and find the values
Query 2 will return
1 -> good
2 -> Bad
3 -> Neural / etc
Index2 I want to use the result [1,2,3,4] for the next query which will give me some extra information based on the ID only. Eg: Query 2 has index=xyz data.msg.id=1, data.xyz.val=good
How can we do that?
I am trying something like this
index="test"
actionSubCateg IN (xyz)
landingPageURL="xyz/?search=game_gupta"
data.msg.queryName="query FindBtf"
| table data.msg.id
Find in second query the results of top
[ search index="test"
actionSubCateg="game"
| rename data.DATA.id as id
| fields id, scope
| table id, scope]
You can also use subsearches. If you want to limit the data from your second search to a list of ids generated in the first search, it's
search2 [ search1 | fields id ]
where the search 1 will do the stats count by uniqueid and make the returned field 'id' in the above case. In the search2, there should be an ID that will then match against the results of search 1.
You can see the effect of what search1 passes to search 2 by running search 1 standalone and adding
| format
to the end
Hi @agupta13,
the easiest solution is the jin command, but it's avery slow and not performant solution, so I hint a different approach like this:
(index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf") OR ([ search index="test"
actionSubCateg="game")
| eval id=if(actionSubCateg="game",'data.DATA.id', 'data.msg.id'
| stats values(scope) AS scope values(data.xyz.val) AS val BY id
in this way you have a row for each id.
if you want you can take only the ids present in both searches adding a little condition
(index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf") OR ([ search index="test"
actionSubCateg="game")
| eval id=if(actionSubCateg="game",'data.DATA.id', 'data.msg.id'
| stats values(scope) AS scope values(data.xyz.val) AS val dc(actionSubCateg) AS actionSubCateg_count BY id
| where actionSubCateg_count>1
Ciao.
Giuseppe