Splunk Search

Comparing even field with lookup field in tstats search?

New Member

Hi all,

I'm quite new so pardon my bad exposition, I'll try my best to explain what i'm trying to achieve.

Can two fields, one from the event itself (ilo.uri), the other from an automatic lookup (il_host) be compared in a "like" fashion (ilo.uri = *il_host*) inside of a tstats search WHERE clause?

Here's my current search:

    | tstats
       values(ilo.level) AS "level"
       FROM datamodel="b2b.ilo"
       WHERE ilOutbound.level IN ("error", "warn") 
       ### AND ilo.uri = *il_host* ###
       BY _time, ilo.level
    | timechart  span=1h
    count(level) AS "level"
    BY ilo.level
Labels (4)
0 Karma

SplunkTrust
SplunkTrust

No, a lookup file cannot be referenced within the tstats command.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

i believe that's incorrect, this simple query works fine:

| tstats values(il_host)
FROM datamodel="b2b.ilo"

0 Karma