Co related sub search in Splunk

[dinesh_wadhwa]

Please help in creating the below search:
Select x.cn_no, (select distinct ad.CD_cd_flag
from act_hist ad

where ad.cn_no = a.cn_no
and ad.seq_no = (select min(xin.seq_no)
from act_hist xin
where xin.cn_no = a.cn_no
and xin.cd_flag in ('L1','B1','B2')
and x.seq_no < xin.seq_no
and x.cd_flag = 'AB')) as Test_ABB

from app a inner join
act_hist x on x.cn_no = a.cn_no
WHERE x.cd_flag in ('AB','AL');

[dinesh_wadhwa]

Sorry, here is the information
1. I have indexed two .csv files (app.csv and act_hist.csv). 2. I have the above SQL from oracle db and trying to build the similar query in Splunk. Please suggest.
Thanks,

[kristian_kolb]

Sorry, but since you provided very little information as to what information you have indexed, it's hard to give any solid advice. However, if you have not yet indexed the data in splunk, follow the instructions from MuS.

[MuS]

Hi dinesh_wadhwa,

/k is correct, best way is to use Splunk search commands.

BUT .... since Splunk can do magic:

Setup Splunk internal DB connector dbconnect and then use the dbquery like this

| dbquery "DB connector name" "YourSQLfu" 

cheers, MuS

[dinesh_wadhwa]

Thanks, but this is not helping me in building the above query 😞

[kristian_kolb]

Perhaps this can be of help.

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/SQLtoSplunk