I have a search from which I extracted field A. In the second search, how do I assign A to be the source of the second search?
For example :
I am using the below query:
index=something host=somevalue source=something/something/something/something/A B [search eventtype=somevalue | table A | dedup A | fields + A] | table B
From the above query what I am expecting is :
My subsearch will return field A.
My outer search will use field A as a source in which I will get result B .
Please help me out with this.
Thanks in advance.
... View more