Hi guys,
I'm having a query that take 2 fields from specific index type, and then going out to the main index in order to get more useful info
for the search.
The query is working only when I put a 1 field from the subsearch, but I want to pass 2 fields from the subsearch
now Its something like:
MAIN INDEX SEARCH |
[ specific sourcetype index search=xxx| table field1 field2]
stats values(fieldx) values(fieldy) values(field1) by field2
So I need to pass 2 of the fields from the subsearch. but it only works with 1 field each time, cant do it with both.
Would like to hear suggestions how to pass 2 fields (or more) from subsearch to the main search
Thanks!!!
↧