Sorry, can you explain more because it has not helped.
I can see that the subsearch will result in a table like the following:
UID
---------
ABC45678
23536352
asfsdfdef434
etc...
But how am I to then try and find events in the secondarydata index using anyone of the results in the table?
For instance (not worrying about field extract at the moment):
index=secondarydata app="payments-service"
[search index="trans" sourcetype=kvp" "ErrorCode=81009" requestid=*AU*
| table requestid] camel.breadcrumbId = requestid
I just want to see the log events from the secondarydata index in the search results that have the same requestid's that were found in the subsearch.
Further, I would also like to do a wildcard match using the UID/requestid where the end of the search might be:
camel.breadcrumbId = *requestid*
... View more