About jamercadoh

jamercadoh · ‎02-08-2013

The sub-search searches data in the "main" index whereas the outer does it in the "agent" index. I tried to include the index=main clause to no avail.

jamercadoh · ‎02-08-2013

The sub-search searches data in the "main" index whereas the outer does it in the "agent" index. I tried to include the index=main clause to no avail.

jamercadoh · ‎02-07-2013

The search string shown below returns valid results when run in Splunk 4.3.4 but it doesn't in Splunk 5.0. index=agent MTRn |fields MTRn S| join S [search svc="*"| fields svc, sessionId Site | rename sessionId AS S]|table MTRn S Site The result shows empty values for the "MTRn" column and the "S" and "site" columns show data from the subsearch. Cheers,

Posts	3
Solutions	0
Karma Given	2
Karma Received	0
Member Since	‎12-13-2012

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

The Join command doesn't combine results from diff...

Re: The Join command doesn't combine results from ...

Re: The Join command doesn't combine results from ...

The Join command doesn't combine results from diff...