Hi all, I performed an initial search, to this I added a second search, with the map command, where based on the values of the OLD field, it performs the search on the same index. index=summary | ...
See more...
Hi all, I performed an initial search, to this I added a second search, with the map command, where based on the values of the OLD field, it performs the search on the same index. index=summary | search PRATICA ="TRAS" AND LA_OLD !=null |dedup LA |table CODICE_,CANALE,ADDRESS,PRATICA, LA,LA_OLD,PACCHETTO,DATA |map [search index=summary LA="$LA_OLD$" |rename LA as LAC_OLD, ADDRESS as ADDRESS_OLD,PACCHETTO as PT_OLD |eval CODE="$CODICE$",LA_NEW="$LA$",CANALE="$CANALE$",PRATICA_G="$PRATICA$",PT_NEW="PACCHETTO$",ADDRESS_NEW="$ADDRESS$",,DATA_MIG="$DATA$" ] maxsearches=9999 |dedup LA_NEW |table CODE,CANALE,PRATICA_G, LA_NEW,LAC_OLD,PT_NEW,PT_OLD,ADDRESS_NEW,ADDRESS_OLD,DATA_MIG the first query finds 1400 events, the second query only finds 250 and returns me only 250. I would like him to give me back all 1400 events but filled in the changes of the 250 (which are the OLDs) Tks BR