How to assign inner search returned value from source1 to outer search field from source2?
Inner search:
index=apic component=faultInst | eval cT = strptime(created, "%Y-%m-%dT%H:%M:%S.%3N") | eval early = relative_time(cT,"-1m") | eval c1 = strftime(early,"%m/%d/%Y:%H:%M")| table c1
Outer search:
index=apic component=aaaModLR |eval created=c1 | table created,affected
Here I want c1 value from inner search to get assigned to outer search, and based on the c1 value match, I need to print created and affected fields from the aaaModLR source.
Your help will be highly appreciated. Thank You!
... View more