Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to I pass 2 fields from subsearch

$
0
0
Hi guys, I'm having a query that take 2 fields from specific index type, and then going out to the main index in order to get more useful info for the search. The query is working only when I put a 1 field from the subsearch, but I want to pass 2 fields from the subsearch now Its something like: MAIN INDEX SEARCH | [ specific sourcetype index search=xxx| table field1 field2] stats values(fieldx) values(fieldy) values(field1) by field2 So I need to pass 2 of the fields from the subsearch. but it only works with 1 field each time, cant do it with both. Would like to hear suggestions how to pass 2 fields (or more) from subsearch to the main search Thanks!!!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>