Hi,
I've a question about sub search, I'm probably misunderstanding docs and other posts.
This is my search:
index=MyIndex [ search index=MyIndex host=as-x | rex " info about (?[A-Z0-9]+)"| rename objectId as search ] stringFilter
The subsearch, executed as a normal search, produce many results, so many objectId.
My expectations is that the final search is like this below:
index=MyIndex (objectId-1 OR objectId-2 OR objectId-3) stringFilter
The behavior is different, only one objectId is used to search and the final search is similar to this:
index=MyIndex (objectId-1) stringFilter
I don't understand why and what I need to change in order to process all objects of subsearch resultset.
Thanks for any kind help
Marcello
... View more