Hey, I have a problem preparing a Splunjk query. Could you assist me?
I have a simple query that returns a table with a few fields:
some-search | fields id, time | table id, time
I also have a macro with two arguments (id and time) that returns a table with status and type fields.
I want to modify the first query somehow to run a subquery for each row by calling my macro and appending the fields to the final table.
Finally, I want to have a table with four fields: id, time, status, and type (where status and type were obtained by calling a subquery with id and time).
Is it possible?
Hi @abroun,
probably this is the only case where join could be the best solution:
some-search
| join type=left id [ search
some-search-index $id$
| eval epoch = _time
| where epoch < $timestamp$
| sort BY _time
| head 1
| fields id status type
]
| table id time status type
Ciao.
Giuseppe
Hi @abroun,
to help you I need also the second search.
In few words, you have to correlate results from both the searches using stats BY common key.
Ciao.
Giuseppe
The second search (macro) is like:
some-search-index $id$
| eval epoch = _time
| where epoch < $timestamp$
| sort BY _time
| head 1
| fields id, status, type
| table id, status, type
Hi @abroun,
probably this is the only case where join could be the best solution:
some-search
| join type=left id [ search
some-search-index $id$
| eval epoch = _time
| where epoch < $timestamp$
| sort BY _time
| head 1
| fields id status type
]
| table id time status type
Ciao.
Giuseppe