About bosseres1

bosseres1 · ‎08-16-2022

I think I understood and the thing is that subsearch generates more than 10000 results, main search can't perform them all.

bosseres1 · ‎08-16-2022

I've tried it, but not works. Though in Index1 there is an event, containing same Logon_ID that I'm trying to find in Index2.

bosseres1 · ‎08-16-2022

yes, I need to get main search with such condition index="2" EventCode=4662 AND (Condition="1" OR Condition="2") AND (Logon_ID="1" OR Logon_ID="2") where (Logon_ID="1" OR Logon_ID="2") are taken from subsearch

bosseres1 · ‎08-16-2022

Hello everyone, asking your help with my subsearch query. I need to find events in index="1", take from it Logon_ID, and run search query in another one index (index="2"). My current search index="2" EventCode=4662 AND (Condition="1" OR Condition="2") [ search index="1" EventCode=4624 Logon_Type=3 | eval Logon_ID=lower(Logon_ID) | eval Logon_ID=mvindex(Logon_ID,-1) | fields Logon_ID] It doesn't work, as I understand main search runs only by 1 Logon_ID, though in index1 there are many Logon_ID values. What could be the reason? Thank you.

Posts	4
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎08-15-2022

Online Status	Offline
Date Last Visited	‎08-16-2022 08:10 AM

Subsearch problem- Why am I only receiving 1 value...

Re: Subsearch problem

Re: Subsearch problem

Re: Subsearch problem

Subsearch problem- Why am I only receiving 1 value...