https://community.splunk.com/t5/Splunk-Search/Nested-Search/m-p/313122#M93745 <P>Hi,<BR /> I have two tables:<BR /> table1:<BR /> share, cost, time<BR /> A , 10 , 2017-02-20<BR /> A , 14 , 2017-02-21<BR /> B , 13 , 2017-02-21<BR /> C , 4 , 2017-02-24<BR /> C , 11 , 2017-02-24</P> <P>table2:<BR /> share, cost, time, name<BR /><BR /> A , 11 , 2017-02-20 , Moshe<BR /><BR /> A , 15 , 2017-02-21, Dani<BR /> B , 13 , 2017-02-21 , Rafael<BR /> B , 4 , 2017-02-24 , John<BR /> C , 11 , 2017-02-24 , George<BR /> A , 22 , 2017-02-20 , Yossi<BR /> A , 9 , 2017-02-21 , Yossi</P> <P>I want to look at A rows from table 1 , and choose (from table 2) the A rows with cost in range +-5 of the original cost (we took from table 1) .</P> <P>I tried to use eval but i think i miss something here </P> <P>Thanks.</P> Tue, 21 Feb 2017 15:56:31 GMT hankmath 2017-02-21T15:56:31Z https://community.splunk.com/t5/Splunk-Search/Nested-Search/m-p/313122#M93745 <P>Hi,<BR /> I have two tables:<BR /> table1:<BR /> share, cost, time<BR /> A , 10 , 2017-02-20<BR /> A , 14 , 2017-02-21<BR /> B , 13 , 2017-02-21<BR /> C , 4 , 2017-02-24<BR /> C , 11 , 2017-02-24</P> <P>table2:<BR /> share, cost, time, name<BR /><BR /> A , 11 , 2017-02-20 , Moshe<BR /><BR /> A , 15 , 2017-02-21, Dani<BR /> B , 13 , 2017-02-21 , Rafael<BR /> B , 4 , 2017-02-24 , John<BR /> C , 11 , 2017-02-24 , George<BR /> A , 22 , 2017-02-20 , Yossi<BR /> A , 9 , 2017-02-21 , Yossi</P> <P>I want to look at A rows from table 1 , and choose (from table 2) the A rows with cost in range +-5 of the original cost (we took from table 1) .</P> <P>I tried to use eval but i think i miss something here </P> <P>Thanks.</P> Tue, 21 Feb 2017 15:56:31 GMT https://community.splunk.com/t5/Splunk-Search/Nested-Search/m-p/313122#M93745 hankmath 2017-02-21T15:56:31Z https://community.splunk.com/t5/Splunk-Search/Nested-Search/m-p/313123#M93746 <P>Give this a try</P> <PRE><CODE>your search for table 2 with fields share, cost, time, name | appeend [search your search for table 1 with fields share, cost, time | rename cost as cost_threshold | eval from="table1"] | eventstats values(cost_threshold) as cost_threshold by share time | where NOT (from="table1") AND abs(cost-cost_threshold)=5 </CODE></PRE> Tue, 21 Feb 2017 16:29:56 GMT https://community.splunk.com/t5/Splunk-Search/Nested-Search/m-p/313123#M93746 somesoni2 2017-02-21T16:29:56Z