All Apps and Add-ons

Splunk DB Connect 2: How to get one search as input to another search in the same dbxquery?

tapptress
Explorer

All my data for this query is using DBX and one table.

I have to select Field A from DBname where Field B=open connection information
Then I need to match the Field A for the following (I only want the Field A values that appear from this query to run against):

select Field A, Field C from DBname where Field B=closed AND Field D > timevalue

Then I am just going to count by Field A Field B for some trending views

Essentially, I am looking at hosts with open tickets, then wanting to trend past outages for only those currently open hosts.

These both work independently.
I've tried subsearch, writing one of them to a lookup, but I'm just not skilled enough yet to figure out how to evaluate the two against each other.

I'd appreciate any suggestions. Thanks

0 Karma
1 Solution

tapptress
Explorer

I figured it out - just had to do a join - go figure.

View solution in original post

0 Karma

tapptress
Explorer

I figured it out - just had to do a join - go figure.

0 Karma
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...