I would like to break "X" field into multiple field based on available value. "X" contain data in following format.  Field X- ABC: YES, APPLICATION: DEF, ZONE: DATA, ENVIRONMENT: DEV ZONE: INSIDE, ENVIRONMENT: PROD ZONE: OUTSIDE, ENVIRONMENT: DEV, ABC: YES, APPLICATION: IJK ======= I would like the arrange data in following format.   ABC     APPLICATION             ZONE           ENVIRONMENT YES           DEF                          DATA                      DEV                                                      INSIDE                  PROD YES           IJK                           OUTSIDE             DEV   TIA.    ... View more

Hello Friends,  I am trying to fetch value of "F5_device"  from search and use as a input to another search to find the result of "syslog_severity". both fields are belongs to same index and sourcetype.  I tried following subsearch query but noticed vast difference between output if ran query separately.  index="f5" sourcetype="f5:enterprise" [search index="f5" sourcetype="f5:enterprise" AND (F5_URL=*abc.com* OR F5_vip=*abc.com* ) | fields + F5_device] |stats count by syslog_severity Also from another  thread i do understand that subsearch have limitation so please suggest if there is any alternative option available for subsearch. I would like to use this query within dashboard. Thank you in advance.           ... View more