I am trying to pass number from subsearch to main search and find before or after 10 values of number. So if number is 50 parent search should pull events from 59 to 59 or 50 to 41.
index=* Number="*" [search index=* "idnumber" | tail 1 | fields Number | format] | head/tail 10
Try like this
index=* [search index=* "idnumber" | tail 1 | table Number |eval Number=mvrange(Number-10,Number+10) ]
Thank you, it worked.
Try like this
index=* [search index=* "idnumber" | tail 1 | table Number |eval Number=mvrange(Number-10,Number+10) ]