Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do I use results from one search in a subsearch?

$
0
0
Trying to use the results of one query in the sub query search. I am not getting the results I expected. The first search returns about 2400 ids, and I want to pull those same id's from the sub query. The results returned are far less than expected; less than 100. It should be exactly the same count as the first query. index=12_access Server connection terminated |stats count by tid| rename tid AS extid|table extid| join extid [search index=13_access ]| stats count by extid,resource. Is the query logic wrong? Any ideas would be greatly appreciated.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>