https://community.splunk.com/t5/Splunk-Search/How-to-return-value-list-from-subsearch-and-use-it-in-main/m-p/133696#M36517 <P>Hello,<BR /> I'm trying to return a list of values from a subsearch to compare that list to other field values in main search. It should look like this:</P> <P>sourcetype=any OR sourcetype=other<BR /> |eval test =[search sourcetype=any OR sourcetype=other<BR /> |streamstats count by field1, field2<BR /> |stats values(field1) AS f1 values(field1) AS f2<BR /> |mvexpand f1<BR /> |eval status =if(match(f2,f1),"True","False")<BR /> |where status ="False"<BR /> |return f1]<BR /> |stats values(field3) as f3<BR /> |where field4 = test<BR /> |table f3</P> <P>Hello,sry that my question above is a bit complicated to understand.What I want to do is this:<BR /> I'm indexing data from two different sourcetypes that have some similar data in different fields. Now I want to compare the values of two fields (field1 and field2) and check if there are some equal values and get a list of that equal values (lets call it "VALUE_LIST"). Then i want to compare other field values (from field3 and field4) of events that have one of the values from VALUE_LIST in their field1 or field2. At the end i need a table with values from VALUE_LIST, field3 and field4 where field3 and field4 are not eqaul. Thanks for the help!</P> Mon, 28 Sep 2020 16:24:11 GMT C_Sparn 2020-09-28T16:24:11Z https://community.splunk.com/t5/Splunk-Search/How-to-return-value-list-from-subsearch-and-use-it-in-main/m-p/133696#M36517 <P>Hello,<BR /> I'm trying to return a list of values from a subsearch to compare that list to other field values in main search. It should look like this:</P> <P>sourcetype=any OR sourcetype=other<BR /> |eval test =[search sourcetype=any OR sourcetype=other<BR /> |streamstats count by field1, field2<BR /> |stats values(field1) AS f1 values(field1) AS f2<BR /> |mvexpand f1<BR /> |eval status =if(match(f2,f1),"True","False")<BR /> |where status ="False"<BR /> |return f1]<BR /> |stats values(field3) as f3<BR /> |where field4 = test<BR /> |table f3</P> <P>Hello,sry that my question above is a bit complicated to understand.What I want to do is this:<BR /> I'm indexing data from two different sourcetypes that have some similar data in different fields. Now I want to compare the values of two fields (field1 and field2) and check if there are some equal values and get a list of that equal values (lets call it "VALUE_LIST"). Then i want to compare other field values (from field3 and field4) of events that have one of the values from VALUE_LIST in their field1 or field2. At the end i need a table with values from VALUE_LIST, field3 and field4 where field3 and field4 are not eqaul. Thanks for the help!</P> Mon, 28 Sep 2020 16:24:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-value-list-from-subsearch-and-use-it-in-main/m-p/133696#M36517 C_Sparn 2020-09-28T16:24:11Z https://community.splunk.com/t5/Splunk-Search/How-to-return-value-list-from-subsearch-and-use-it-in-main/m-p/133697#M36518 <P>Your <CODE>stats</CODE>/<CODE>streamstats</CODE> use is a mess, so it's futile to try to gather your requirements from the search. Do explain your use case in natural language instead.</P> Wed, 16 Apr 2014 17:03:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-value-list-from-subsearch-and-use-it-in-main/m-p/133697#M36518 martin_mueller 2014-04-16T17:03:27Z https://community.splunk.com/t5/Splunk-Search/How-to-return-value-list-from-subsearch-and-use-it-in-main/m-p/133698#M36519 <P>Hello,<BR /> the solution for that problem was using inner join and a where clause for field 3 and 4:</P> <P>sourcetype=any | eval Tickets=TicketNumber |join type=inner Tickets [search sourcetype=other | eval Tickets=TicketNumberOther] |where UserId != UserIdOther |stats values(UserId) values(UserIdOther) by Tickets</P> <P>Greetings<BR /> C_Sparn</P> Thu, 14 Aug 2014 07:01:02 GMT https://community.splunk.com/t5/Splunk-Search/How-to-return-value-list-from-subsearch-and-use-it-in-main/m-p/133698#M36519 C_Sparn 2014-08-14T07:01:02Z