Using where condition

[john]

source="D:\SplunkLogs\status.log" |search data|rex field=_raw "control\s(?.*)" |stats values(myvalue)|where myvalue="append
[| inputlookup value.csv | where Values="BB"|stats values(ID)]"

This is how my file is

status.log value.csv

myvalue Data value Id

100004 xxxxx BB 10003
100005 xxxxx AA 100005
10003

this is the search query i was trying to fetch data related to myvalue from status log file using value from another csv file but its not working.How to use subqueries inside a where condition or wether it is possible in Splunk.Please help

[sowings]

I don't know offhand whether it's possible directly in "where" like your example, but I would achieve this with a lookup table. By tying the value.csv lookup table to your search, a new field (say "text_id") would be in the returned results, then your where condition could read "where text_id="AA"".

[lguinn2]

You can't use subqueries inside a where condition. You should probably setup value.csv as a lookup in Splunk - it would make what you are doing much easier.

See Lookup Fields from External Data Sources for more info