If now I extract top 10 src-ip and use this src-ip to do further outer search, but I still wanna keep the field "count" calculated by "stats count by src-ip", how can I remain this field and its value or append to outer search? if I keep this count value, the outer search should not search anything due to not having the field named count.
asked 12 Aug '11, 16:47
It depends on what you're looking for. Can you put your search in, or explain the situation a bit more?
One way that can make this work is to go:
But that's almost certainly an inefficient way, and you we can get you a better one if you post some more details.
answered 13 Aug '11, 00:57