Hi, I'm searching for specific IP's in proxy index and trying to compare the output of that to other index (which gives the additional info about those IP's which match the condition i gave in proxy logs index) but i'm not getting any result.
I need to do above in only 1 search. I'm using subsearch command but unable to get any result. individually both are working fine if i run 1st search then pick those IP's and give it into 2nd index manually. Right now i'm using:
index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | fields ip] stats values(ipinfo) values(fileds in index ipinfo).
i think subsearch can be used with same index only, that's why it is not working. Or the fields i'm comparing have different names. do i need to rename fields in subsearch before comparing to main search?
Please help
was it a typo or did you miss a "|" before the stats command?
your query - index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | fields ip] stats values(ipinfo)
index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | fields ip] | stats values(ipinfo)...
Also, make sure that field name that contains IP ifnormation is same in both proxylogs and ipinfo index. If not that add a rename command in subsearch to make both field name same.
index=ipinfo ip_s="ip" [search index=proxylogs "conditions" | stats count by ip | table ip | rename ip as ipFieldNameInipinfoIndex ] | stats values(ipinfo)...