https://community.splunk.com/t5/Splunk-Search/Using-where-condition/m-p/100953#M26077 <P>You can't use subqueries inside a where condition. You should probably setup value.csv as a lookup in Splunk - it would make what you are doing <EM>much</EM> easier.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addfieldsfromexternaldatasources">Lookup Fields from External Data Sources</A> for more info</P> Mon, 26 Mar 2012 14:30:38 GMT lguinn2 2012-03-26T14:30:38Z https://community.splunk.com/t5/Splunk-Search/Using-where-condition/m-p/100952#M26076 <P>source="D:\SplunkLogs\status.log" |search data|rex field=_raw "control\s(?<MYVALUE>.*)" |stats values(myvalue)|where myvalue="append<BR /> [| inputlookup value.csv | where Values="BB"|stats values(ID)]"</MYVALUE></P> <P>This is how my file is</P> <P>status.log value.csv</P> <P>myvalue Data value Id<BR /><BR /> 100004 xxxxx BB 10003 <BR /> 100005 xxxxx AA 100005<BR /> 10003 </P> <P>this is the search query i was trying to fetch data related to myvalue from status log file using value from another csv file but its not working.How to use subqueries inside a where condition or wether it is possible in Splunk.Please help</P> Mon, 26 Mar 2012 12:05:19 GMT https://community.splunk.com/t5/Splunk-Search/Using-where-condition/m-p/100952#M26076 john 2012-03-26T12:05:19Z https://community.splunk.com/t5/Splunk-Search/Using-where-condition/m-p/100953#M26077 <P>You can't use subqueries inside a where condition. You should probably setup value.csv as a lookup in Splunk - it would make what you are doing <EM>much</EM> easier.</P> <P>See <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Addfieldsfromexternaldatasources">Lookup Fields from External Data Sources</A> for more info</P> Mon, 26 Mar 2012 14:30:38 GMT https://community.splunk.com/t5/Splunk-Search/Using-where-condition/m-p/100953#M26077 lguinn2 2012-03-26T14:30:38Z https://community.splunk.com/t5/Splunk-Search/Using-where-condition/m-p/100954#M26078 <P>I don't know offhand whether it's possible directly in "where" like your example, but I would achieve this with a lookup table. By tying the value.csv lookup table to your search, a new field (say "text_id") would be in the returned results, then your where condition could read "where text_id="AA"".</P> Mon, 26 Mar 2012 14:40:39 GMT https://community.splunk.com/t5/Splunk-Search/Using-where-condition/m-p/100954#M26078 sowings 2012-03-26T14:40:39Z