I am getting Username and User id Fields while search using username, then I pipe it and search user ID to get the password. How to put them in a table TABLE USERNAME USERID PASSWORD like this.
index!=_internal "USERNAME" | TABLE USERNAME USERID | SEARCH index!=_internal "$USERID$" | TABLE USERNAME USERID PASSWORD
The search above is not working.
Sorry i didn't convey my question correctly.- This is not an exact scenario but i am trying to make a similar scenario.
Let me explain it clearly.
After First search - i am able to take USERNAME AND USERID in a table.
First search : index = something "USERNAME" | table USERNAME USERID
Second search - i am searching all the USERID feilds taken in first search and taking password in the second search for that userid . so i am take USERID and PASSWORD table here.
index = something "USERNAME" | Index = something "$USERID$" | TABLE USERID PASSWORD
i am able to join two searches using join
index = something "USERNAME" | table USERNAME USERID | join USERID [SEARCH index = something "USERNAME" | Index = something "$USERID$" | TABLE USERID PASSWORD ] | table USERNAME USERID PASSWORD.
But i feel like i am using the same search (index = something "USERNAME" ) twice in the join scenario.
Please how to get that three feild in one search itself
Hi mohanmk,
Please check this one -
index!=_internal "USERNAME" OR "$USERID$" | TABLE USERNAME USERID PASSWORD
Hi mohanmk1905,
After a table command, the only fields you have are the ones you listed in table: in your example you haven't PASSWORD field in the first table, so, in the following pipes you haven't PASSWORD field, but only USERNAME and USERID.
Every way it's strange the way you have to build your search:
Probably your search is better like something:
index=* "USERNAME" "$USERID$" | TABLE USERNAME USERID PASSWORD
Bye.
Giuseppe
sorry sir i conveyed my question correctly now
Hi mohanmk1905,
every way the problem is the same: if you haven't password field in the first table command, you haven't it in the second one, try the search I suggested: the output of a command on the left of the pipe "|" is the input for the command on the right of the pipe "|".
bye.
Giuseppe