Hi,
I have a main query which returns below 4 columns:
rule, result, name, department
Now i have to add another query as subsearch where i want to get column address for all the name returned from 1st result. I have fullname column in subsearch index which is same as name from 1st query . how to achieve this .
Hi @surekhasplunk ,
you have two choices:
using Join:
your_search_1
| join name [ search your_search_2 | rename fullname AS name ]
| table rule result name department address
using stats:
your_search_1 OR your_search_2
| rename fullname AS name
| stats values(rule) AS rule values(result) AS result values(department) AS department values(address) AS address By name
Ciao.
Giuseppe