topic How to write one more tstats query in tsatas where clause? in Splunk Cloud Platform

How to write one more tstats query in tsatas where clause?

manikanthkoti — Wed, 08 Jul 2020 10:19:49 GMT

Hi Everyone,

I am looking for writing tstats sub search in query in tstats where claus.

I tried the below way but my query giving No Result. I want write in sub search with tstats from two indexes.

Query:

| tstats latest(_time),values(relational_correlationId),values(tracePoint),values(timestamp),values(businessKey),values(businessValue) where [ tstats latest(_time) as _time ,values(relational_correlationId) as relational_correlationId ,values(tracePoint) as tracePoint,values(timestamp) as timestamp,values(content.businessFields{}.key) as businessKey,values(content.businessFields{}.value) as businessValue where index="mulesoft_index" earliest=-10m@m latest=now() by environment,businessGroup,appName,interfaceName,correlationId]

Please help me.

Thanks & Reagards,

Manikanth

Re: How to write one more tstats query in tsatas where clause?

richgalloway — Wed, 08 Jul 2020 14:28:35 GMT

Recall that the results of a subsearch become part of the main search so those results must make sense in the context of the main search. To check that, run the subsearch by itself with the format command so you can see what gets returned to the main search.

| tstats latest(_time) as _time ,values(relational_correlationId) as relational_correlationId ,values(tracePoint) as tracePoint,values(timestamp) as timestamp,values(content.businessFields{}.key) as businessKey,values(content.businessFields{}.value) as businessValue where index="mulesoft_index" earliest=-10m@m latest=now() by environment,businessGroup,appName,interfaceName,correlationId | format

Re: How to write one more tstats query in tsatas where clause?

manikanthkoti — Thu, 09 Jul 2020 06:18:43 GMT

Hi richgalloway,

Thanks for your response. I have tried the way you suggested but it is not working. Actually In sub search I want to get the data from other summary index.

Re: How to write one more tstats query in tsatas where clause?

richgalloway — Thu, 09 Jul 2020 12:22:14 GMT

What about it is not working? What results do you get vs what you expect?
If you want the subsearch to get data from a summary index then modify the subsearch to get the data from the SI.