hi every one,
I want to make a search that could give me the same result of SQL Querie
select id_product from products where price = (
select max price from products )
thank you
Hi All,
I am trying correlate 2 different search queries using where with subsearch
it goes like this:
host="host1" | table Value1
above search give result : 40
host="host2" | where V...
Hi, I am having a situation where a lookup table defines search filters that needs to be used as part of search query. The dynamic filter (data_owner_filter) is built from original search results a...
I am getting subsearch error while using the join command in my search. I have to use join command to connect 2 sources and show the result. I have tried configuring limits.conf using following p...
Hello I use the search below in order to calculate a volume percentage | inputlookup host.csv
| lookup lookup_patch "Computer" as host output FileName, StateName
| search S...
Is it possible to create a new search based off of results of previous search. My example below I use regex to extract a new column with all my users names that are extracted from User.
i...
Hi Splunk friends, looking for some help in this use case
i'm trying to use results from asubsearch to feed a search, however;
1) subsearch is results of a regex pull
2) i would like the r...
I am trying to create a search that gets the top value of a search and saves it to a variable:
| eval top=[| eval MB_in=bytes_in/1024/1024 | stats sum(MB_in) by c_ip | rename sum(MB_in) as "T...
...able Host VM Application
Above is the search that I'm using. When I use this query, data from both subsearches is displayed. However, if I limit the search by application name, I only see results f...
...n the metadata results but I need to have them show in the final results.
I was thinking asubsearch would work but it fails to match up all the records. I only get about 20 matching records but it d...