topic How to correlate index with dbxquery with condition or interation? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-correlate-index-with-dbxquery-with-condition-or/m-p/675321#M231084 <P>How to correlate index with dbxquery with condition or interation?<BR /><BR />See the sample below.&nbsp; &nbsp;Thank you for your help.<BR />index=company</P><TABLE width="417"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>CompanyName</STRONG></TD><TD width="174"><STRONG>Revenue</STRONG></TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD></TR></TBODY></TABLE><P><BR />|&nbsp; dbxquery query="select * from employee where companyID in (A,B,C)"<BR />OR&nbsp;<BR />Iteration:<BR />|&nbsp; dbxquery query="select * from employee where companyID ='A'<BR />|&nbsp; dbxquery query="select * from employee where companyID ='B'<BR />|&nbsp; dbxquery query="select * from employee where companyID ='B'<BR /><BR /></P><TABLE width="417"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>EmployeeName</STRONG></TD><TD width="174"><STRONG>EmployeeEmail</STRONG></TD></TR><TR><TD>A</TD><TD>EmployeeA1</TD><TD>empA1@email.com</TD></TR><TR><TD>A</TD><TD>EmployeeA2</TD><TD>empA2@email.com</TD></TR><TR><TD>A</TD><TD>EmployeeA3</TD><TD>empA2@email.com</TD></TR><TR><TD>B</TD><TD>EmployeeB1</TD><TD>empB1@email.com</TD></TR><TR><TD>B</TD><TD>EmployeeB2</TD><TD>empB2@email.com</TD></TR><TR><TD>B</TD><TD>EmployeeB3</TD><TD>empB3@email.com</TD></TR><TR><TD>C</TD><TD>EmployeeC1</TD><TD>empC1@email.com</TD></TR><TR><TD>C</TD><TD>EmployeeC2</TD><TD>empC2@email.com</TD></TR><TR><TD>C</TD><TD>EmployeeC3</TD><TD>empC3@email.com</TD></TR></TBODY></TABLE><P><BR />Expected result:</P><TABLE width="691"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>CompanyName</STRONG></TD><TD width="149"><STRONG>Revenue</STRONG></TD><TD width="126"><STRONG>EmployeeName</STRONG></TD><TD width="173"><STRONG>EmployeeEmail</STRONG></TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA1</TD><TD>empA1@email.com</TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA2</TD><TD>empA2@email.com</TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA3</TD><TD>empA2@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB1</TD><TD>empB1@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB2</TD><TD>empB2@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB3</TD><TD>empB3@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC1</TD><TD>empC1@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC2</TD><TD>empC2@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC3</TD><TD>empC3@email.com</TD></TR></TBODY></TABLE><P><BR />OR&nbsp;<BR /><BR /></P><TABLE width="1082"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>CompanyName</STRONG></TD><TD width="149"><STRONG>Revenue</STRONG></TD><TD width="274"><STRONG>EmployeeName</STRONG></TD><TD width="416"><STRONG>EmployeeEmail</STRONG></TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA1, EmployeeA2, EmployeeA3</TD><TD>empA1@email.com, empA2@email.com, empA2@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB1, EmployeeB2, EmployeeB3</TD><TD>empB1@email.com, empB2@email.com, empB3@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC1, EmployeeC2, EmployeeC3</TD><TD>empC1@email.com, empC2@email.com, empC3@email.com</TD></TR></TBODY></TABLE><P><BR /><BR /><BR /></P> Wed, 24 Jan 2024 22:41:07 GMT LearningGuy 2024-01-24T22:41:07Z How to correlate index with dbxquery with condition or interation? https://community.splunk.com/t5/Splunk-Search/How-to-correlate-index-with-dbxquery-with-condition-or/m-p/675321#M231084 <P>How to correlate index with dbxquery with condition or interation?<BR /><BR />See the sample below.&nbsp; &nbsp;Thank you for your help.<BR />index=company</P><TABLE width="417"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>CompanyName</STRONG></TD><TD width="174"><STRONG>Revenue</STRONG></TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD></TR></TBODY></TABLE><P><BR />|&nbsp; dbxquery query="select * from employee where companyID in (A,B,C)"<BR />OR&nbsp;<BR />Iteration:<BR />|&nbsp; dbxquery query="select * from employee where companyID ='A'<BR />|&nbsp; dbxquery query="select * from employee where companyID ='B'<BR />|&nbsp; dbxquery query="select * from employee where companyID ='B'<BR /><BR /></P><TABLE width="417"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>EmployeeName</STRONG></TD><TD width="174"><STRONG>EmployeeEmail</STRONG></TD></TR><TR><TD>A</TD><TD>EmployeeA1</TD><TD>empA1@email.com</TD></TR><TR><TD>A</TD><TD>EmployeeA2</TD><TD>empA2@email.com</TD></TR><TR><TD>A</TD><TD>EmployeeA3</TD><TD>empA2@email.com</TD></TR><TR><TD>B</TD><TD>EmployeeB1</TD><TD>empB1@email.com</TD></TR><TR><TD>B</TD><TD>EmployeeB2</TD><TD>empB2@email.com</TD></TR><TR><TD>B</TD><TD>EmployeeB3</TD><TD>empB3@email.com</TD></TR><TR><TD>C</TD><TD>EmployeeC1</TD><TD>empC1@email.com</TD></TR><TR><TD>C</TD><TD>EmployeeC2</TD><TD>empC2@email.com</TD></TR><TR><TD>C</TD><TD>EmployeeC3</TD><TD>empC3@email.com</TD></TR></TBODY></TABLE><P><BR />Expected result:</P><TABLE width="691"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>CompanyName</STRONG></TD><TD width="149"><STRONG>Revenue</STRONG></TD><TD width="126"><STRONG>EmployeeName</STRONG></TD><TD width="173"><STRONG>EmployeeEmail</STRONG></TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA1</TD><TD>empA1@email.com</TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA2</TD><TD>empA2@email.com</TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA3</TD><TD>empA2@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB1</TD><TD>empB1@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB2</TD><TD>empB2@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB3</TD><TD>empB3@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC1</TD><TD>empC1@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC2</TD><TD>empC2@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC3</TD><TD>empC3@email.com</TD></TR></TBODY></TABLE><P><BR />OR&nbsp;<BR /><BR /></P><TABLE width="1082"><TBODY><TR><TD width="125"><STRONG>CompanyID</STRONG></TD><TD width="118"><STRONG>CompanyName</STRONG></TD><TD width="149"><STRONG>Revenue</STRONG></TD><TD width="274"><STRONG>EmployeeName</STRONG></TD><TD width="416"><STRONG>EmployeeEmail</STRONG></TD></TR><TR><TD>A</TD><TD>CompanyA</TD><TD>3,000,000</TD><TD>EmployeeA1, EmployeeA2, EmployeeA3</TD><TD>empA1@email.com, empA2@email.com, empA2@email.com</TD></TR><TR><TD>B</TD><TD>CompanyB</TD><TD>2,000,000</TD><TD>EmployeeB1, EmployeeB2, EmployeeB3</TD><TD>empB1@email.com, empB2@email.com, empB3@email.com</TD></TR><TR><TD>C</TD><TD>CompanyC</TD><TD>1,000,000</TD><TD>EmployeeC1, EmployeeC2, EmployeeC3</TD><TD>empC1@email.com, empC2@email.com, empC3@email.com</TD></TR></TBODY></TABLE><P><BR /><BR /><BR /></P> Wed, 24 Jan 2024 22:41:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-correlate-index-with-dbxquery-with-condition-or/m-p/675321#M231084 LearningGuy 2024-01-24T22:41:07Z Re: How to correlate index with dbxquery with condition or interation? https://community.splunk.com/t5/Splunk-Search/How-to-correlate-index-with-dbxquery-with-condition-or/m-p/675322#M231085 <P>Run both queries then combine the results using <FONT face="courier new,courier">stats</FONT>.</P><LI-CODE lang="markup">| dbxquery query="select * from employee where companyID in (A,B,C)" | append [search index=company] | stats values(*) as * by Company ID</LI-CODE><P>&nbsp;</P> Thu, 25 Jan 2024 00:11:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-correlate-index-with-dbxquery-with-condition-or/m-p/675322#M231085 richgalloway 2024-01-25T00:11:00Z Re: How to correlate index with dbxquery with condition or interation? https://community.splunk.com/t5/Splunk-Search/How-to-correlate-index-with-dbxquery-with-condition-or/m-p/675450#M231106 <P>Hello <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;,<BR />Thanks for your help.&nbsp; &nbsp;It's odd that I didn't receive notification when you responded.<BR />1) It looks like it also works if I do the index first, then DBX query.&nbsp;<BR />2) How do I put company ID in the brackets on DBX query dynamically?<BR />&nbsp; &nbsp; eval variable = .....&nbsp; &nbsp;A, B, C, ...&nbsp; &nbsp;Z&nbsp; (Company ID)&nbsp;<BR />&nbsp; &nbsp; where companyID in $variable$<BR /><BR />index=company<BR />| append<BR />[&nbsp;| dbxquery query="select * from employee where companyID in (A,B,C)"<BR />| stats values(*) as * by CompanyID</P> Thu, 25 Jan 2024 22:16:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-correlate-index-with-dbxquery-with-condition-or/m-p/675450#M231106 LearningGuy 2024-01-25T22:16:30Z