index=xx sourcetype=yy |eval ..|table aa
[| search index=xx1 sourcetype=yy1 yy=aa values |table yy zz ff ] in a single search ..
Hi Nadhiya123,
if you want to use a field of the soubsearch to filter the main search you have to run something like this:
index=xx1 sourcetype=yy1 [ search index=xx sourcetype=yy |eval .. | rename aa AS yy | table yy ]
|table yy zz ff
you have only to put attention that fieldname is the same both in main and sub search (use rename command in subsearch) and remember that subsearch has 50,000 events limit.
If instead you want to use a field to join two searches, you can run something like this:
index=xx sourcetype=yy
| eval ..
| join aa [| search index=xx1 sourcetype=yy1 ]
| table aa yy zz ff
Bye.
Giuseppe
how can I include maxout in my subsearch since its truncating the results
To modify the 50,000 limit for subsearches results you have to modify limits.conf file, but with attention!
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf?ac=partner_smt
bye.
Giuseppe
Is there an option to include in the SPL query
No! only in limits.conf configuration file.
Bye.
Giuseppe