search within a sub-search

[atenciodeyka]

I have been working on a search for a table view, what I want is to be able to see the results from this search from two different time frames o the same table, the first time frame brings back the results correctly; when I use the search command to run the same search with a different time frame to display it on the table is when things don't seem to be going well. This is the search:

index="XXX" sourcetype="XXX" host=$host1$ earliest=-37d@d latest=-30d@d action="drop" OR action=blocked | top limit=20 src | append [search index="XXX" sourcetype="XXXX" host=$host1$ earliest=-7d@d latest=now action="drop" OR action=blocked | top limit=20 src ]

[atenciodeyka]

Ok, the only problem is that on the table I can't see both fields (src), the one from seach 1 and the other one from serch.

[nick405060]

you didn't table src, is that the problem?

[Sukisen1981]

if you can see _time,_raw and host all you need is to add src field to the table

[nick405060]

What exactly is the issue you're having? You should be able to do this without a problem.

I do exactly this pretty often - the only immediate difference I notice is that you don't have quotations around $host1$. Try that.

[Sukisen1981]

Looks like you are checking the search events , can you try this and check in the statistics tab?

index="XXX" sourcetype="XXX" host=$host1$ earliest=-37d@d latest=-30d@d action="drop" OR action=blocked | top limit=20 src |table _time,host,_raw| append [search index="XXX" sourcetype="XXXX" host=$host1$ earliest=-7d@d latest=now action="drop" OR action=blocked | top limit=20 src |table _time,host,_raw]