Splunk Search

Comparing even field with lookup field in tstats search?

loat01
New Member

Hi all,

I'm quite new so pardon my bad exposition, I'll try my best to explain what i'm trying to achieve.

Can two fields, one from the event itself (ilo.uri), the other from an automatic lookup (il_host) be compared in a "like" fashion (ilo.uri = *il_host*) inside of a tstats search WHERE clause?

Here's my current search:

    | tstats
       values(ilo.level) AS "level"
       FROM datamodel="b2b.ilo"
       WHERE ilOutbound.level IN ("error", "warn") 
       ### AND ilo.uri = *il_host* ###
       BY _time, ilo.level
    | timechart  span=1h
    count(level) AS "level"
    BY ilo.level
Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

No, a lookup file cannot be referenced within the tstats command.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

loat01
New Member

i believe that's incorrect, this simple query works fine:

| tstats values(il_host)
FROM datamodel="b2b.ilo"

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!