I have a search with one subsearch, that looks like this.
sourcetype=sourcetype1 <search string> [search sourcetype=sourcetype2 <search string>|fields + src_ip dst_ip message|stats values(dst_ip) AS Network_Address] | fields + hostname Network_Address | search hostname!="*Unknown*" OR hostname!="-"|convert ctime(_time) AS timestamp | stats values(Network_Address) AS dst_ip values(hostname) AS Hostname values(src_ip) AS SourceIP values(message) AS Message count by timestamp
What the whole search should do is get the dst_ip address from the subsearch, input the values into the main search, then main search gets the hostname of the dst_ip values. After the searching, it should be tabled to display the fields "timestamp" "src_ip" "dst_ip" "hostname" "message"
The fields or values for the fields "src_ip" and "message" are not picked up and rendered in the main search table. How do I get those fields included?
... View more