All Apps and Add-ons

sql "IN" in splunk

0range
Communicator

Hello!
Is it possible to implement anything like SQL "in" clause in splunk?

like this:
select a from A where b in (select b from B)

inner join is not a good way, as I see, when there are several million of rows in A and a couple in B.

any ideas? thank you in advance

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Yes. Use subsearches.

http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchTutorial/Useasubsearch

sourcetype=a [sourcetype=B | fields b] | fields a

View solution in original post

Ayn
Legend

Yes. Use subsearches.

http://docs.splunk.com/Documentation/Splunk/6.0.3/SearchTutorial/Useasubsearch

sourcetype=a [sourcetype=B | fields b] | fields a
Get Updates on the Splunk Community!

Splunk App for Anomaly Detection End of Life Announcment

Q: What is happening to the Splunk App for Anomaly Detection?A: Splunk is officially announcing the ...

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...