You must have a command after the pipe and before the subsearch. | search [search index=* | stats count by user [search index=* | stats count by component If a search has a set of nested subsearches, the inner most subsearch is run first, followed by the next inner subsearch, working out to the outermost subsearch and then the primary search.įor example, you have the following search. You can use more than one subsearch in a search. Certain commands, such as append and join can accept a subsearch as an argument. ![]() For example, you cannot use a subsearch with " sourcetype=top | multikv", because the multikv command does not expect a subsearch as an argument.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |