Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

use a result value, as fieldname in subsearch

$
0
0

I have a first search, that return "system1"

Then I want to use that value, to get the appropriate value out of a subsearch timechart :
first restult : system system1

second result : system1 system2 system3 _time 1 2 3 _time 4 5 4 _time 4 4 4

How could I do that ? is there a way to put the first result in a parameter, that could be used in the subsearch as fieldname ?

index=myfirstquery | table system | subsearch [ _time=$_time$ | eval myValue=fieldName[$system$]]


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>