https://community.splunk.com/t5/Splunk-Search/How-to-pull-a-value-from-one-column-based-on-condition-on/m-p/284566#M190676 <P>Looks like there's a typo in your question. <CODE>like(message, "COMPLETE")</CODE> likely should be <CODE>like(msg_type,"COMPLETE")</CODE>.</P> Wed, 27 Jul 2016 12:23:07 GMT richgalloway 2016-07-27T12:23:07Z https://community.splunk.com/t5/Splunk-Search/How-to-pull-a-value-from-one-column-based-on-condition-on/m-p/284565#M190675 <P>I am trying to run an equivalent of the below query in splunk search, please help.</P> <P>SELECT CONCAT(run, '.', tag) as file_name,time_at as end_time FROM log WHERE message = 'processing' and msg_type = 'COMPLETE' order by id desc</P> <P>index=history source=mysql-pipe sourcetype=pipeline_logs|eval file_name=run_name.".".tag |eventstats time_at as start_time where like(message,"processing") AND like(message,"COMPLETE") |table file_name start_time </P> Tue, 29 Sep 2020 10:24:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pull-a-value-from-one-column-based-on-condition-on/m-p/284565#M190675 infoneo 2020-09-29T10:24:17Z https://community.splunk.com/t5/Splunk-Search/How-to-pull-a-value-from-one-column-based-on-condition-on/m-p/284566#M190676 <P>Looks like there's a typo in your question. <CODE>like(message, "COMPLETE")</CODE> likely should be <CODE>like(msg_type,"COMPLETE")</CODE>.</P> Wed, 27 Jul 2016 12:23:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-pull-a-value-from-one-column-based-on-condition-on/m-p/284566#M190676 richgalloway 2016-07-27T12:23:07Z