https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197383#M57034 <P>I managed to get this working by adding stats count max(end_date) as maxisdate to my stats command to determine the end_date of my calls to Country A. I then in my query qualifying criteria used where start_date&gt;maxisdate to ensure the other calls happened afterwards</P> Mon, 28 Sep 2020 17:28:10 GMT garryclarke 2020-09-28T17:28:10Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197380#M57031 <P>I am trying to identify calls from an originating number where a small number ie 1 or 2 are first made to country A followed by a large number of calls to any country.<BR /> I have tried this with a join but cant seem to figure out the time part so that calls to country A have happened first.</P> <P>index=main Country!=NULL | join type=inner caller_no [search index=main Country=Country_A | stats count by caller_no | search count&lt;3] | stats count by caller_no | search count &gt;50</P> <P>Any help much appreciated</P> Mon, 28 Sep 2020 17:25:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197380#M57031 garryclarke 2020-09-28T17:25:44Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197381#M57032 <P>Sorry, I couldn't understand your question. Do you have an example of your data and an example how the report should look like?</P> <P>The only thing I can think now is using the command:</P> <PRE><CODE>| eventstats count AS calls BY Country,caller_no </CODE></PRE> <P>It would add to each event the number of calls a "caller_no" did to each country (computed over all events). From there you might be able to extract what you're after, like:</P> <PRE><CODE>| stats max(calls),min(calls) by caller_no </CODE></PRE> Thu, 28 Aug 2014 02:05:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197381#M57032 musskopf 2014-08-28T02:05:46Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197382#M57033 <P>Thanks musskopf To provide a real life example I am trying to run a report to identify callers who for example make 1 or 2 calls to the UK followed by a large number of calls to another country. The report would then produce a list of callerids and the total of calls. </P> <P>01234567986 56 </P> <P>09458765784 21 </P> <P>The query I provided above gets the report correctly its just the logic within the joins to say that the calls to country A ie the UK where made before the other calls.</P> Thu, 28 Aug 2014 08:35:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197382#M57033 garryclarke 2014-08-28T08:35:20Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197383#M57034 <P>I managed to get this working by adding stats count max(end_date) as maxisdate to my stats command to determine the end_date of my calls to Country A. I then in my query qualifying criteria used where start_date&gt;maxisdate to ensure the other calls happened afterwards</P> Mon, 28 Sep 2020 17:28:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-to-identify-calls-to-Country-A-followed-by-calls/m-p/197383#M57034 garryclarke 2020-09-28T17:28:10Z