All Apps and Add-ons

Splunk DB Connect 2: How to get one search as input to another search in the same dbxquery?

Explorer

All my data for this query is using DBX and one table.

I have to select Field A from DBname where Field B=open connection information
Then I need to match the Field A for the following (I only want the Field A values that appear from this query to run against):

select Field A, Field C from DBname where Field B=closed AND Field D > timevalue

Then I am just going to count by Field A Field B for some trending views

Essentially, I am looking at hosts with open tickets, then wanting to trend past outages for only those currently open hosts.

These both work independently.
I've tried subsearch, writing one of them to a lookup, but I'm just not skilled enough yet to figure out how to evaluate the two against each other.

I'd appreciate any suggestions. Thanks

0 Karma
1 Solution

Explorer

I figured it out - just had to do a join - go figure.

View solution in original post

0 Karma

Explorer

I figured it out - just had to do a join - go figure.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!