topic How to Evaluate a field from the list of another search and create a table in Splunk Search

How to Evaluate a field from the list of another search and create a table

manorajk — Tue, 31 May 2022 14:04:31 GMT

There are two queries

`query 1` will give ID, TIME fields

`query 2` will give list of SPECIAL_ID

I want to create a table with TIME, ID, IS_SPECIAL_ID

IS_SPECIAL_ID is evaluated to true/false based on the condition where is ID is part of the list SPECIAL_ID

Re: Evaluate a field from the list of another search

ITWhisperer — Tue, 31 May 2022 08:09:37 GMT

Simplistically, you could do something like this

However, as has been mentioned in numerous posts, using join and subsearches is not always best practice due to the limitations of subsearches, but if the above suffices, it is a simple approach.

Re: How to Evaluate a field from the list of another search and create a table

manorajk — Wed, 01 Jun 2022 05:34:48 GMT

@ITWhisperer Really appreciate your help here.