Splunk Search

Using where condition


source="D:\SplunkLogs\status.log" |search data|rex field=_raw "control\s(?.*)" |stats values(myvalue)|where myvalue="append
[| inputlookup value.csv | where Values="BB"|stats values(ID)]"

This is how my file is

status.log value.csv

myvalue Data value Id

100004 xxxxx BB 10003
100005 xxxxx AA 100005

this is the search query i was trying to fetch data related to myvalue from status log file using value from another csv file but its not working.How to use subqueries inside a where condition or wether it is possible in Splunk.Please help

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

I don't know offhand whether it's possible directly in "where" like your example, but I would achieve this with a lookup table. By tying the value.csv lookup table to your search, a new field (say "text_id") would be in the returned results, then your where condition could read "where text_id="AA"".

0 Karma


You can't use subqueries inside a where condition. You should probably setup value.csv as a lookup in Splunk - it would make what you are doing much easier.

See Lookup Fields from External Data Sources for more info