I have a sourcetype called sourcetype1 that contains the following three events:
foo=a
foo=b
foo=c
I then have a sourcetype called sourcetype2 that contains the following 4 events:
bar=x, othervalue=4
bar=y, othervalue=3
bar=z, othervalue=2
bar=a, othervalue=1
If I do the simple search
index=myindex sourcetype=sourcetype1 | fields foo
I get back the expected 3 events: a, b, c.
I then try to use the map command
index=myindex sourcetype=sourcetype1 | fields foo | map search="search index=myindex sourcetype=sourcetype2 bar=$foo$"
and I get the error
[SimpleResultsTable module] Server reported HTTP status=400 while getting mode=results Error in 'map' command: Unable to run query 'search index=index2 bar=a'.
which makes me sad.
To further my confusion if I try a search just to get some different results
index=myindex sourcetype=sourcetype1 | fields foo | map search="search index=myindex sourcetype=sourcetype2 bar=x"
I end up the results
a
b
c
which acts as if the subsearch never occurred. Any thoughts?
Thanks,
Kevin
... View more