how to do a join query on pre-parsed fields

Comments

2 comments

  • Avatar
    Kelly Hamm
    Hi MB- I would basically start with my search to create my initial scope, then use a simple where after the fact to break that scope out into my separate subtables I want to join: _sourcecategory = SCA or _sourcecategory = SCB | join (* | where _sourcecategory="SCA") as a, (* |where _sourcecategory="SCB") as b on a.server_ip=b.server_ip in this case my server_IP is my join field, and since both subsets already have that field parsed with FER, it works successfully. There's different variations you can try here to parcel off data in the subtables, but the net result is that you do not have to insert a parse statement to achieve a join. Let us know if that gets you closer to your goal!
    0
    Comment actions Permalink
  • 0
    Comment actions Permalink

Please sign in to leave a comment.