Splunk Search

Where with subsearch

nkankur
Path Finder

Hi All,

I am trying correlate 2 different search queries using where with subsearch
it goes like this:

host="host1" | table Value1
above search give result : 40

host="host2" | where Value2<40
above search gives a list of events

But when I use above two in one search query like:
host="host2" | where Value2>[host="host1" | table Value1]

it's giving error : Error in 'where' command: Typechecking failed. The '<' operator received different types.

Kindly help!

0 Karma
1 Solution

somesoni2
Revered Legend

The subsearch is returning field name as well, hence it fails (your where clause becomes | where Value2>Value=40). Try any of below

host="host2" | where Value2>[host="host1" | table Value1 | return $Value1]

OR

host="host2" | where Value2>[host="host1" | table Value1 | rename Value1 as search]

View solution in original post

somesoni2
Revered Legend

The subsearch is returning field name as well, hence it fails (your where clause becomes | where Value2>Value=40). Try any of below

host="host2" | where Value2>[host="host1" | table Value1 | return $Value1]

OR

host="host2" | where Value2>[host="host1" | table Value1 | rename Value1 as search]

nkankur
Path Finder

Thanks a lot! It worked!

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...