Hi, there, I am working on following search and somehow cannot append the search as part of the "fit DensityFunction" table result from search macro "search_macro_smart($cef_ruleid$)" splunk_server="splunk" index="area" source="area1" sourcetype="dsystem_events" | stats count by cef_ruleid | sort - count | head 85 | map search="search `search_macro_smart($cef_ruleid$)`" maxsearches=85 | join [| makeresults | eval current_id=$cef_ruleid$ | stats values(current_id)] The search macro "search_macro_smart($cef_ruleid$)" will be generate 85 raw of data for outlier with data in past 45 days and I need the append "cef_ruleid " as part of the search macro output on dashboard so we can know the detected outlier belong to which ""cef_ruleid " Your help is appreciated, mason
... View more