dbxquery returns statistics instead of events for subquery

[teknet9]

Hello,

I want to:
- run a search for specific syslog messages
- filter out all those which have a corresponding field in mysql table column

I wanted to do subsearch like:
host="10.62.140.64" Field1 NOT []
and put inside [] my |dbxquery

But then noticed that dbxquery is not returning any events which could be used for subsearch but statistics only.
Can i use dbquery for subsearch ? (to filter out my main syslog search) ? Could you provide any example ?

Thanks,
Michal

[teknet9]

Thank you Somesoni2,

It does not work for me. My final search:

host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation NOT [|dbxquery query="SELECT mac FROM endpoints.endpoints" connection="MYSQL" shortnames=true | fields - _* | rename mac as EndPointMACAddress | table EndPointMACAddress]

The first part: "host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation" is returning syslog message with "EndpointMacAddress=00:50:B6:11:EA:CE". The second part "|dbxquery query="SELECT mac FROM endpoints.endpoints" connection="MYSQL" shortnames=true | fields - _* | rename mac as EndPointMACAddress | table EndPointMACAddress" is returning the table with EndPointMACAddress column and one of the values is 00:50:B6:11:EA:CE.

Why is that happening ?
The search like this:
host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation NOT [00:50:B6:11:EA:CE] is working fine. So it is something wrong with dbxquery conjunction....

Thanks,
Michal

[somesoni2]

Yes, the subsearch with dbxquery will be used as filter, so it shouldn't be returning events but the field that you want to use as filter. The syntax should be like this

host="10.62.140.64" NOT [|dbxquery...| table Field1 ]

This will get translated as this after subsearch has returned results

host="10.62.140.64" NOT (Field1="ValueFromdbxquery1" OR Field1="ValueFromdbxquery2"...)