Knowledge Management

How to search in an index conditioned from the summary index.

spisiakmi
Communicator

Hi. I have summary index_sum, which has 2 events, 2 attributes:

A1_sum, A2_sum
1590482539, 7722527
1591080961, 7722525

I have also index2, where a lot of time events are stored. The index time _time is important. I want to search the max(A1_sum) from index_sum and use this value to filter values from the index2.
something like this:
index2
| where _time>max(A1_sum)

can you help me, please, with this problem?

Labels (1)
0 Karma
1 Solution

493669
Super Champion

I haven't tested but you can try return command like below-

index=index2  |search _time>[search index=index_sum |stats max(A1_sum) as max|return $max]

View solution in original post

493669
Super Champion

I haven't tested but you can try return command like below-

index=index2  |search _time>[search index=index_sum |stats max(A1_sum) as max|return $max]

spisiakmi
Communicator

Hi 493669. Your answer/help is amazing. It works absolutely great. Thank you very much.

0 Karma

493669
Super Champion

@spisiakmi I am converting my comment into answer. Please accept and upvote if it helps.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...