Splunk Cloud Platform

How to write one more tstats query in tsatas where clause?

manikanthkoti
Explorer

Hi Everyone,

I am looking for writing tstats sub search in query in tstats where claus.

I tried the below way but my query giving No Result. I want write in sub search with tstats from two indexes.

Query:

 

| tstats latest(_time),values(relational_correlationId),values(tracePoint),values(timestamp),values(businessKey),values(businessValue)  where [  tstats latest(_time) as _time ,values(relational_correlationId) as relational_correlationId ,values(tracePoint) as tracePoint,values(timestamp) as timestamp,values(content.businessFields{}.key) as businessKey,values(content.businessFields{}.value) as businessValue where index="mulesoft_index" earliest=-10m@m latest=now() by environment,businessGroup,appName,interfaceName,correlationId]

 

Please help me.

Thanks & Reagards,

Manikanth

 

 

Labels (2)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Recall that the results of a subsearch become part of the main search so those results must make sense in the context of the main search.  To check that, run the subsearch by itself with the format command so you can see what gets returned to the main search.

| tstats latest(_time) as _time ,values(relational_correlationId) as relational_correlationId ,values(tracePoint) as tracePoint,values(timestamp) as timestamp,values(content.businessFields{}.key) as businessKey,values(content.businessFields{}.value) as businessValue where index="mulesoft_index" earliest=-10m@m latest=now() by environment,businessGroup,appName,interfaceName,correlationId | format
---
If this reply helps you, Karma would be appreciated.
0 Karma

manikanthkoti
Explorer

Hi 

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust
What about it is not working? What results do you get vs what you expect?
If you want the subsearch to get data from a summary index then modify the subsearch to get the data from the SI.
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...