topic Re: Comparing even field with lookup field in tstats search? in Splunk Search

Comparing even field with lookup field in tstats search?

loat01 — Mon, 08 Jun 2020 19:21:14 GMT

Hi all,

I'm quite new so pardon my bad exposition, I'll try my best to explain what i'm trying to achieve.

Can two fields, one from the event itself (ilo.uri), the other from an automatic lookup (il_host) be compared in a "like" fashion (ilo.uri = *il_host*) inside of a tstats search WHERE clause?

Here's my current search:

    | tstats
       values(ilo.level) AS "level"
       FROM datamodel="b2b.ilo"
       WHERE ilOutbound.level IN ("error", "warn") 
       ### AND ilo.uri = *il_host* ###
       BY _time, ilo.level
    | timechart  span=1h
    count(level) AS "level"
    BY ilo.level

Re: Comparing even field with lookup field in tstats search?

richgalloway — Thu, 28 May 2020 16:53:39 GMT

No, a lookup file cannot be referenced within the tstats command.

Re: Comparing even field with lookup field in tstats search?

loat01 — Fri, 29 May 2020 07:54:38 GMT

i believe that's incorrect, this simple query works fine:

| tstats values(il_host) FROM datamodel="b2b.ilo"