source="D:\SplunkLogs\status.log" |search data|rex field=_raw "control\s(?
[| inputlookup value.csv | where Values="BB"|stats values(ID)]"
This is how my file is
myvalue Data value Id
100004 xxxxx BB 10003
100005 xxxxx AA 100005
this is the search query i was trying to fetch data related to myvalue from status log file using value from another csv file but its not working.How to use subqueries inside a where condition or wether it is possible in Splunk.Please help
I don't know offhand whether it's possible directly in "where" like your example, but I would achieve this with a lookup table. By tying the value.csv lookup table to your search, a new field (say "text_id") would be in the returned results, then your where condition could read "where text_id="AA"".
You can't use subqueries inside a where condition. You should probably setup value.csv as a lookup in Splunk - it would make what you are doing much easier.
See Lookup Fields from External Data Sources for more info