Hi All,
I have a lookup table which contains fields like name , id,etc but not timestamp.
In the log file I will be having the _time value as well as an id.
I would like to identify the count of id in lookup as well as in the logs over time.
Please find below the query I have used to fetch the count.
inputlookup test1 | eventstats count as A
|search not
[subsearch] |event stats count as B
Please suggest how to pass _time to the main search
The problem here is that _time
is considered to be an internal field, and as such won't get picked up by the format
command that is implicitly run by the subsearch, so it will not be included in the subsearch output.
However using a little workaround we can get the output we want anyway, by creating a field called query
which will contain the _time
filtering string. query
is a special field whose value is returned from the subsearch as-is rather than Splunk adding "query=" before it.
[search yoursubsearch | eval query="_time="._time | fields query]