Dear all,
If now I extract top 10 src-ip and use this src-ip to do further outer search, but I still wanna keep the field "count" calculated by "stats count by src-ip", how can I remain this field and its value or append to outer search? if I keep this count value, the outer search should not search anything due to not having the field named count.
Thanks
It depends on what you're looking for. Can you put your search in, or explain the situation a bit more?
One way that can make this work is to go:
YourOuterSearch | join src-ip [search YourInnerSearch | stats count by src-ip]
But that's almost certainly an inefficient way, and you we can get you a better one if you post some more details.