Hi, how to a must write search then set fields from general search to subsearch?
Example:
index=name host=thishost | eval ip=iphost+"\\" | eval counts=[ search index=name2 | where iphost=ip | return $iphost ]
Field ip
created in general search, how to use this field to subsearch?
How I must make it?
Thanks
Since subsearches execute before the main search, nothing created by the main search is available in the subsearch.
Since subsearches execute before the main search, nothing created by the main search is available in the subsearch.