how to extract the query stored in form of a key value pair in a lookup and execute the query in a single go in search app.
For ex- |makeresults|eval field1= "index=*|stats count "| --> how can we pass the value in filed1 which is a query and execute it within the same search.
Please help: @somesoni2 @woodcock @martin_mueller @niketnilay
You do this with map
, like this:
| makeresults
| eval field1= "index=* | stats count"
| map search="search $field1$"
This construct is particularly useful when creating workflow actions
.