Hi All,
I'm trying to pass result of one query to other. but not able to achieve this.
Can someone help on this.
Query1
index = "internal" sourcetype= "*" Space = "*" Microservice="*" | eval Microservice=lower(Microservice) | dedup Space,Microservice| stats count by Microservice | where count>1
query2
index ="internal" sourcetype= "*" Space = "*" Microservice="*" Org="*" | table Microservice Org Space
result of first query is
Microservice count
app1 2
app2 2
app3 3
so i want to pass this Microservices to second query and get result as
Microservice Org Space
Here i'm trying to find duplicate microservices and get Org and space accordingly.
Try using join command like below
Query 1 | join Microservice type=left[search Query2]
Thankyou
I'm able to join . but i'm not getting result as expected.
I want the result to be as
Org Space Microservice count
org1 space1 app1 1
Org2 space2 app1 1
but i'm getting result as
Org Space Microservice count
Org1 Space app1 2
here i want to find duplicate microservice along with Org and space values.
Can u help on this