The search below produces multiple values for c_ip
index=proxy*
| fields c_ip s_op d_ip r_host d_port cs_bytes cs_uri referer c_agent
| lookup RedSkyIOCip-Proxy Indicator AS d_ip OUTPUT Source ReferenceAttribution
| search Source=RedSkyIOC
| table _time c_ip d_ip Source ReferenceAttribution cs_uri referer c_agent
When it is modified to become a subsearch as below, the subsearch only returns 1 value for c_ip. What is not working?
index=in_index
[ search index=proxy
| fields c_ip s_op d_ip r_host d_port cs_bytes cs_uri referer c_agent
| lookup RedSkyIOCip-Proxy Indicator AS d_ip OUTPUT Source ReferenceAttribution
| search Source=RedSkyIOC
| dedup c_ip
| rename c_ip AS s_ip
| return s_ip ]
| table _time s_ip d_ip d_port action | sort s_ip
The return
command defaults to returning a single value. Try replacing it with a field
command.