Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Using the results of one search to perform another
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to list ALL customers who bought a watch and then use their userId to list out all of their purchases(not limited to watches).
I'm trying to solve this using subsearches. But, its not helping. Can anyone suggest a solution?
source="foobar"
[search xxx OR yyy OR zzz source="foobar" mdn
| rex field=_raw "(?[0-9]+)" max_match=0
| dedup MDN
| rename MDN as search]
| rex field=_raw "(?[0-9]+)" max_match=0
| dedup orderid
| stats list(orderId) by MDN
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @vjzone,
Try something similar after changing the logic according to your events,
index="your index" source=foobar purchase=* [index="your index" source=foobar purchase=watch |table userid|dedup userid]
Below reference might give you some idea ,
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @vjzone,
Try something similar after changing the logic according to your events,
index="your index" source=foobar purchase=* [index="your index" source=foobar purchase=watch |table userid|dedup userid]
Below reference might give you some idea ,
What goes around comes around. If it helps, hit it with Karma 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi @vjzone, lets know if you still have questions
What goes around comes around. If it helps, hit it with Karma 🙂
Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud
Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know
October Community Champions: A Shoutout to Our Contributors!
