<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: use subsearch in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/use-subsearch/m-p/172424#M49403</link>
    <description>&lt;P&gt;thank you &lt;STRONG&gt;woodcock&lt;/STRONG&gt;&lt;BR /&gt;
it works perfectly. have a nice day&lt;/P&gt;</description>
    <pubDate>Wed, 06 May 2015 07:51:01 GMT</pubDate>
    <dc:creator>otman01</dc:creator>
    <dc:date>2015-05-06T07:51:01Z</dc:date>
    <item>
      <title>use subsearch</title>
      <link>https://community.splunk.com/t5/Splunk-Search/use-subsearch/m-p/172422#M49401</link>
      <description>&lt;P&gt;hi every one, &lt;/P&gt;

&lt;P&gt;I want to make a search that could give me the same result of SQL Querie&lt;/P&gt;

&lt;P&gt;select id_product from products where price = (&lt;BR /&gt;
select max price from products ) &lt;/P&gt;

&lt;P&gt;thank you &lt;/P&gt;</description>
      <pubDate>Tue, 05 May 2015 15:42:10 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/use-subsearch/m-p/172422#M49401</guid>
      <dc:creator>otman01</dc:creator>
      <dc:date>2015-05-05T15:42:10Z</dc:date>
    </item>
    <item>
      <title>Re: use subsearch</title>
      <link>https://community.splunk.com/t5/Splunk-Search/use-subsearch/m-p/172423#M49402</link>
      <description>&lt;P&gt;sourcetype=products  | eventstats max(price) AS maxPrice | where price=maxPrice | stats values(id_product)&lt;BR /&gt;
OR&lt;BR /&gt;
sourcetype=products  | eventstats max(price) AS maxPrice | where price=maxPrice | fields id_product&lt;/P&gt;</description>
      <pubDate>Mon, 28 Sep 2020 19:49:57 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/use-subsearch/m-p/172423#M49402</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2020-09-28T19:49:57Z</dc:date>
    </item>
    <item>
      <title>Re: use subsearch</title>
      <link>https://community.splunk.com/t5/Splunk-Search/use-subsearch/m-p/172424#M49403</link>
      <description>&lt;P&gt;thank you &lt;STRONG&gt;woodcock&lt;/STRONG&gt;&lt;BR /&gt;
it works perfectly. have a nice day&lt;/P&gt;</description>
      <pubDate>Wed, 06 May 2015 07:51:01 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/use-subsearch/m-p/172424#M49403</guid>
      <dc:creator>otman01</dc:creator>
      <dc:date>2015-05-06T07:51:01Z</dc:date>
    </item>
  </channel>
</rss>

