Splunk Enterprise Security

How to I pass 2 fields from subsearch

squatforeever
New Member

Hi guys,
I'm having a query that take 2 fields from specific index type, and then going out to the main index in order to get more useful info
for the search.
The query is working only when I put a 1 field from the subsearch, but I want to pass 2 fields from the subsearch
now Its something like:

MAIN INDEX SEARCH |
[ specific sourcetype index search=xxx| table field1 field2]
stats values(fieldx) values(fieldy) values(field1) by field2

So I need to pass 2 of the fields from the subsearch. but it only works with 1 field each time, cant do it with both.

Would like to hear suggestions how to pass 2 fields (or more) from subsearch to the main search

Thanks!!!

0 Karma

anmolpatel
Builder
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...