i have six scheduled searches.the results of all six searches will create a report.in order to create that report i have to collate the search results.how can i do it??
I am not sure if you can auto append scheduled jobs. But you could append each search in one search job. Sort of like the below.
search user=* | append [search machine=cat] | append [search eventtype=failure]
But after using append also i am getting search result only for the first search.Other search results are not appearing.:(
is there any specific format append has to be used