https://community.splunk.com/t5/Splunk-Search/Subsearch-help/m-p/65022#M16067 <P>Duplicate post , answered here :</P> <P><A href="http://splunk-base.splunk.com/answers/40056/help-with-subsearch">http://splunk-base.splunk.com/answers/40056/help-with-subsearch</A></P> Sat, 04 Feb 2012 05:27:04 GMT Damien_Dallimor 2012-02-04T05:27:04Z https://community.splunk.com/t5/Splunk-Search/Subsearch-help/m-p/65021#M16066 <P>I have two different kinds of events. I would like to relate the two. The first event looks like this.</P> <P>[2012-02-02 20:17:51,931] INFO - sessionId=8AD487DD-DB3F-4C3E-AB9A-302ABF05E6FC code=NewsStandPushNotificationReceived externalSignInStatus=true</P> <P>The second looks like this.</P> <P>[2012-02-02 20:18:03,050] INFO - sessionId=8AD487DD-DB3F-4C3E-AB9A-302ABF05E6FC code=NewsStandPushCompleted startedBackgroundDownload=true</P> <P>I would like to find all the sessionIds where startedBackgroundDownload=false from the second event and externalSignInStatus=true from the first event.</P> <P>I think I would be able to do this with a subsearch, but nothing I've tried has resulted in anything but 0 matching events. Can anyone help me with a subsearch that would do what I need?</P> Sat, 04 Feb 2012 01:31:45 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-help/m-p/65021#M16066 mburbidg 2012-02-04T01:31:45Z https://community.splunk.com/t5/Splunk-Search/Subsearch-help/m-p/65022#M16067 <P>Duplicate post , answered here :</P> <P><A href="http://splunk-base.splunk.com/answers/40056/help-with-subsearch">http://splunk-base.splunk.com/answers/40056/help-with-subsearch</A></P> Sat, 04 Feb 2012 05:27:04 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-help/m-p/65022#M16067 Damien_Dallimor 2012-02-04T05:27:04Z