topic Where with subsearch in Splunk Search

Where with subsearch

nkankur — Wed, 18 Apr 2018 20:53:51 GMT

Hi All,

I am trying correlate 2 different search queries using where with subsearch
it goes like this:

host="host1" | table Value1
above search give result : 40

host="host2" | where Value2<40
above search gives a list of events

But when I use above two in one search query like:
host="host2" | where Value2>[host="host1" | table Value1]

it's giving error : Error in 'where' command: Typechecking failed. The '<' operator received different types.

Kindly help!

somesoni2 — Wed, 18 Apr 2018 21:03:28 GMT

The subsearch is returning field name as well, hence it fails (your where clause becomes | where Value2>Value=40). Try any of below

host="host2" | where Value2>[host="host1" | table Value1 | return $Value1]

host="host2" | where Value2>[host="host1" | table Value1 | rename Value1 as search]

nkankur — Wed, 18 Apr 2018 21:17:09 GMT

Thanks a lot! It worked!