use subsearch

[otman01]

hi every one,

I want to make a search that could give me the same result of SQL Querie

select id_product from products where price = (
select max price from products )

thank you

[woodcock · Accepted solution]

sourcetype=products | eventstats max(price) AS maxPrice | where price=maxPrice | stats values(id_product)
OR
sourcetype=products | eventstats max(price) AS maxPrice | where price=maxPrice | fields id_product

[otman01]

thank you woodcock
it works perfectly. have a nice day