hi all,
how to pass search result to savedsearch .
example
index="_internal" |eval a=one|table a
how to pass result "a" as saved search name like "|savedsearch
Try something like this
|savedsearch [search index="_internal" |eval a=one|table a | return $a] | table *
what error you're getting?