Splunk Search

Co related sub search in Splunk

New Member

Please help in creating the below search:
Select x.cn_no, (select distinct ad.CD_cd_flag
from act_hist ad

where ad.cn_no = a.cn_no
and ad.seq_no = (select min(xin.seq_no)
from act_hist xin
where xin.cn_no = a.cn_no
and xin.cd_flag in ('L1','B1','B2')
and x.seq_no < xin.seq_no
and x.cd_flag = 'AB')) as Test_ABB

from app a inner join
act_hist x on x.cn_no = a.cn_no
WHERE x.cd_flag in ('AB','AL');

Tags (3)
0 Karma

New Member

Sorry, here is the information
1. I have indexed two .csv files (app.csv and act_hist.csv). 2. I have the above SQL from oracle db and trying to build the similar query in Splunk. Please suggest.

0 Karma

Ultra Champion

Sorry, but since you provided very little information as to what information you have indexed, it's hard to give any solid advice. However, if you have not yet indexed the data in splunk, follow the instructions from MuS.

0 Karma


Hi dinesh_wadhwa,

/k is correct, best way is to use Splunk search commands.

BUT .... since Splunk can do magic:

Setup Splunk internal DB connector dbconnect and then use the dbquery like this

| dbquery "DB connector name" "YourSQLfu" 

cheers, MuS

New Member

Thanks, but this is not helping me in building the above query 😞

0 Karma

Ultra Champion
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!