Hello folks, i have a list of hardware for an account X and i want to know if all the hawrdware list is present in other query which is the hardware list for my Y and Z account. Query for X account index=x sourcetype=hw | table productId,index | dedup productId,index Query for Y and Z accounts index=x or index=z sourcetype=hw | table productId,index | dedup productId,index i would like to obtain a table similar like this: .COLUMNA | COLUMNB productIdX | is in Y | index ........routerx | true..| z ...... switchx | false.| y ..... firewallx | true..| y thansk in advance for your help. ... View more

Hi experts, im trying to definde a variable in my search to use is in other search. it should work as a filter in the other search. "companyNames" is a sourcetype where several company names,Keys are stored for example Key 100001 is customer1. on the other hand i have the sourcetype "groups" which contains groups for all the companies. what im trying to do is to filter my second seach by searching the key 100001 so i can define a variable which will be the index for the other search, the indexes for groups are "key-cc" so this is why i define the variable id1 as "Key-cc" but the second search is empty. sourcetype=companyNames Key=100001 | eval id1= Key."-cc" | search sourcetype=groups index=id1 | table groupId,groupName if i search like this: sourcetype=groups index=100001-cc | table groupId,groupName the search have values. please your help telling me what im doing wrong. thanks in advance. ... View more