Splunk Search

Using the field of first search in second search.

email2vamsi
Explorer

Hi experts,

Search 1:
    base search from JSON...
    | eval col1=strptime(taken_date,"%b %d %Y %H:%M:%S")
    | stats latest(col1) as max_col

The above search returns a single value.
Based on the single value max_col, i would like to run the below search which displays the
values of col1 only when col1 > (max_col-2629743).

   Search 2:
    base search from JSON...
    | eval col1=strptime(taken_date,"%b %d %Y %H:%M:%S")
    | eval max_col1_30= max_col-2629743
    | where col1 > max_col1_30
    | table col1 max_col1_30

Could you please help by joining both the searches?
Sub search is not working for me.
Thank you.

Labels (4)
0 Karma

to4kawa
Ultra Champion

use eventstats instead of stats

0 Karma
Get Updates on the Splunk Community!

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...

Splunk and Fraud

Watch Now!Watch an insightful webinar where we delve into the innovative approaches to solving fraud using the ...