You don't need to use the IN construct when using subsearches, as the default returned from a subsearch is field=A OR field=B or field=C... so in practice you can just do index=index2 [
search index=index1 service IN (22, 53, 80, 8080)
| table src_ip
| rename src_ip as dev_ip
]
| table dev_ip, OS_Type however, how many src_ips are you likely to get back from this subsearch? If you get a large number, this may not perform well at all. In that case you will have to approach the problem in a different way, e.g. index=index2 OR (index=index1 service IN (22, 53, 80, 8080))
``` Creates a common dev_ip field which is treated as the common field
between the two indexes ```
| eval dev_ip=if(index=index2, dev_ip, src_ip)
``` Now we need the data to be seen in both indexes, so count the indexes
and collect the OS_Type values and split by that common dev_ip field ```
| stats dc(index) as indexes values(OS_Type) as OS_Type by dev_ip
``` And this just ensures we have seen the data from both places ```
| where indexes=2
| fields - indexes A third way to attack this type of problem is using a lookup, where you maintain a list of the src_ips you want to match for in a lookup table. Which one you end up with, will depend on your data and its volume as they will have different performance characteristics. Hope this helps
... View more
