Hi all,
I have below query and the results like below table, is there a way that only search and display total count for the Users who have error(User1, User2, User3)?
index=aaa sourcetype=...
Hello,
Help me please. I'd like to define multiple search or subsearch to merge all relevant information about alerts.
Interesting fields in search are the hosts - as managed_host field a...
index="_internal" user!=admin | [search index="_internal" | stats count by user]
I am trying to run above query but it fails with an error that "Error in 'SearchParser': Subsearches are only v...
...ourcetype=ironport mailto=%form_var%
which will result in a fields that I can use (icid) to then find the mailfrom field. So I am thinking about a subsearch like:
index=email sourcetype=i...
I'm trying to sort smartsheets by certain combinations of row/column values. If I remove one of the 'foreach' blocks, the search works, outputting a new field. With both, however, the search returns ...
...o go about this?
I tried using Map and the following, but neither seemed to work.
index=voice [search index=voice "ani" "8005558508"
| rex field=_raw "{\"ani\",\"(?<ani>\d*)\"}"
| rex f...
..." only returns about 300 results, but the subsearch is searching across millions of users accounts. If I removed the sub search, the outer search only takes a few seconds to complete.
Does a...
...as to use subsearch so firstly I search for the DNSRequests then search the Process information.
event_simpleName=ProcessRollup2 [search event_simpleName=DnsRequest
| fields + C...
...n the metadata results but I need to have them show in the final results.
I was thinking a subsearch would work but it fails to match up all the records. I only get about 20 matching records but it d...
Hello,
I would like to run a scheduled report once. A very log time search, I don't care about performance or time to complete.
I set in local limits.conf
[subsearch]
# maximum number of r...