...ollows to only get the most recent of either the start / completed log event. index=anIndex sourcetype=aSourcetype aJobName AND "START of script" | head 1 | append [ index=anIndex sourcetype=a...
I need help to append this rest command to my query. The problem is that the rest command is adding to the first row and I need it to be added to the row that was last entered. | rest /services/a...
...bserved unexpected behavior when testing approaches using | inputlookup append=true ... vs | append [| inputlookup ... ] . Here are a series of screenshots documenting what I found.
I created t...
Hi All, I have the below search. I am being told it appends results to a lookup table called user_ids.
index=ad earliest=-15d
|stats latest(_time) as _time, latest(p...
Hello, How to join data from index and dbxquery without using JOIN, APPEND or stats command? Issue with JOIN: limit of subsearch 50,000 rows or fewer. Missing data. Issue with APPEND...