Nested Search

[hankmath]

Hi,
I have two tables:
table1:
share, cost, time
A , 10 , 2017-02-20
A , 14 , 2017-02-21
B , 13 , 2017-02-21
C , 4 , 2017-02-24
C , 11 , 2017-02-24

table2:
share, cost, time, name

A , 11 , 2017-02-20 , Moshe

A , 15 , 2017-02-21, Dani
B , 13 , 2017-02-21 , Rafael
B , 4 , 2017-02-24 , John
C , 11 , 2017-02-24 , George
A , 22 , 2017-02-20 , Yossi
A , 9 , 2017-02-21 , Yossi

I want to look at A rows from table 1 , and choose (from table 2) the A rows with cost in range +-5 of the original cost (we took from table 1) .

I tried to use eval but i think i miss something here

Thanks.

[somesoni2]

Give this a try

your search for table 2 with fields share, cost, time, name 
| appeend [search your search for table 1 with fields share, cost, time | rename cost as cost_threshold | eval from="table1"]
| eventstats values(cost_threshold) as cost_threshold by share time | where NOT (from="table1") AND abs(cost-cost_threshold)=5