Join Same Saved Search

[sanjay_shrestha]

Hi,

I created generic saved search and it is running fine individually as below

|savedsearch PausedTime_SS index_name=one_index

However, when I called them twice and joined them with common field

|savedsearch PausedTime_SS index_name=one_index
|join Day [|savedsearch PausedTime_SS index_name=other_index]

I am getting following:

Error in 'SearchParser': Found circular dependency when expanding savedsearch=PausedTime_SS

Is it possible to join same saved searches?

Thanks,

Sanjay

[richgalloway]

Have a look at the selfjoin command. See http://docs.splunk.com/Documentation/Splunk/6.0.1/SearchReference/Selfjoin