Splunk Search

I am using subsearch and trying to pass ID from sub to the main and trying to calculate minimum of time by ID using tstats. My normal query is working fine.

Path Finder

Normal index query :

searchA[search search B|stats count by _time,BusinessIdentifier|return BusinessIdentifier]|stats min(_time) as E by BusinessIdentifier

Tstats query:

|tstats min(_time) as E from datamodel=A where nodename=B [|tstats dc(Fusion.BusinessIdentifier) as "Fusion" from datamodel=A where nodename=C by Fusion.BusinessIdentifier|return Fusion.BusinessIdentifier]|stats min(_time) as E by Fusion.BusinessIdentifier

0 Karma

SplunkTrust
SplunkTrust

I assume both 'tstats' in your search works independently. Are you missing "search" and minor change ?

| tstats count from datamodel=A where nodename=B | search [|tstats dc(Fusion.BusinessIdentifier) as "Fusion" from datamodel=A where nodename=C by Fusion.BusinessIdentifier|return Fusion.BusinessIdentifier]|stats min(_time) as E by Fusion.BusinessIdentifier

0 Karma

Path Finder

It is passing only one BusinessIdentifier. If i put something like this:

| tstats count from datamodel=A where nodename=B | search [|tstats dc(Fusion.BusinessIdentifier) as "Fusion" from datamodel=A where nodename=C by Fusion.BusinessIdentifier|return 10000 Fusion.BusinessIdentifier]|stats count as E by Fusion.BusinessIdentifier

it is working.

But i want to pass all the identifiers..numbers should not limit.

I tried with limit=0 and also tried rename Fusion.BusinessIdentifier as search.
Both not working.

0 Karma