Hi @nkavouris , you can use a subsearch to filter results in the main search passing the fields with the same name and putting attention to pass only the fields to use for filtering, in your case: ...
See more...
Hi @nkavouris , you can use a subsearch to filter results in the main search passing the fields with the same name and putting attention to pass only the fields to use for filtering, in your case: keystone_time, serial_number, message, after but not model that isn't used in the main search. The problem is the message field because you need to use it as a part of the search, ib this case you have to rename it in "query": search index="june_analytics_logs_prod"
[[search index="june_analytics_logs_prod" (message=* new_state: Diagnostic, old_state: Home*)
| spath serial output=serial_number
| spath message output=message
| spath model_number output=model
| eval
keystone_time=strftime(_time,"%Y-%m-%d %H:%M:%S.%Q"),
before=keystone_time-10,
after=_time+10,
eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S.%Q")
| rename message AS query
| fields keystone_time serial_number query after ] the renaming of message AS query permits to search in full text search mode. I didn't use it with other fields, only by itself, but it should run. Ciao. Giuseppe