returning multiple fields with multiple values from sub search to main search

[kvmanjunath]

I am trying to create a search where sub-search returns 2 fields. Field 1) list of servers 2) time.

now for example., I get 3 results from the sub-search as host1, host2 and host3 for server field along with that I get 3 time which is host1_time, host2_time and host3_time.

I want to search (host1 from host1_time to host1_time + 8 hours) and (host2 from host2_time to host2_time + 8 hours) and (host3 from host3_time to host3_time + 8 hours) I tried many type of search but it is not working.

Sub-search can return n value for server field and n value for time field. Any help would be appreciated.

[alacercogitatus]

I do this using time modifiers. Basically I use the subsearch to find the events, do some time based calculations, reformat the output to not include the implicit AND, and then the subsearch modifies the main search.

The subsearch returns something like : (host=host1 earliest=host1_time latest=host1_time+8 ) OR (host=host2 earliest=host2_time latest=host2_time+8 )

So your whole search looks like this:

main_search [search index=wherever| stats min(_time) as earliest by host|eval latest=earliest+(8*3600)|format "" "(" "" ")" "OR" ""]

[alacercogitatus]

Yes, the earliest and latest time modifiers for each host take care of that. As long as main_search is pretty generic ( sourcetype=syslog for example) you should ind what you need.

[kvmanjunath]

Does it works if sub-search returns n results? for example sub-search returns more than 5 servers and 5 different times for 5 servers.