Splunk Search

use subsearch

otman01
Communicator

hi every one,

I want to make a search that could give me the same result of SQL Querie

select id_product from products where price = (
select max price from products )

thank you

0 Karma
1 Solution

woodcock
Esteemed Legend

sourcetype=products | eventstats max(price) AS maxPrice | where price=maxPrice | stats values(id_product)
OR
sourcetype=products | eventstats max(price) AS maxPrice | where price=maxPrice | fields id_product

View solution in original post

0 Karma

woodcock
Esteemed Legend

sourcetype=products | eventstats max(price) AS maxPrice | where price=maxPrice | stats values(id_product)
OR
sourcetype=products | eventstats max(price) AS maxPrice | where price=maxPrice | fields id_product

0 Karma

otman01
Communicator

thank you woodcock
it works perfectly. have a nice day

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...