The datamodel don't have the src and dest ip address, so I want to use the indexes return from datamodel and perform further search in the main search. Do you mean you want to use additional dat...
See more...
The datamodel don't have the src and dest ip address, so I want to use the indexes return from datamodel and perform further search in the main search. Do you mean you want to use additional data from that datamodel to enrich the main search? In that case, subsearch is the wrong tool. How you use datamodel will depend on what you want to do with this main search. (Here, let me lay out elements of an answerable question so you don't confuse volunteers in the future: Illustrate your dataset (or explain in detail), illustrate the desired output, explain the logic between illustrated data and desired output (without SPL). If you do illustrate sample SPL, illustrate actual output, too, then explain how it differs from desired output if it is not painfully obvious.) Let me do a simple illustration. If your main search without datamodel is index=myindex sourcetype=mytype abc=*
| stats values(abc) as abc by def suppose it returns something like def abc def1 aaa bbb ccc def2 bbb ddd fff def3 aaa and if your datamodel search returns src_ip, dst_ip, and def, like this: def src_ip dst_ip def1 1.1.1.1 2.2.2.2 def2 1.2.1.1 2.1.2.1 def3 1.2.3.4 2.4.6.8 def4 4.3.2.1 8.6.4.2 You want the additional fields associated with def to be shown. Then, you can do index=myindex sourcetype=mytype abc=*
| append
[ datamodel Tutorial Client_errors index]
| stats values(abc) as abc values(src_ip) as src_ip values(dst_ip) as dst_ip by def This way, you get def abc src_ip dst_ip def1 aaa bbb ccc 1.1.1.1 2.2.2.2 def2 bbb ddd fff 1.2.1.1 2.1.2.1 def3 aaa 1.2.3.4 2.4.6.8 If your search and desired output are different, there are other ways to accomplish your goal but you have to be specific.