Hello @skoelpin  I was trying to list the events between date and hour range in Source B where date range and hour range was extracted from Source A. Idea was to show the relevant events in table. Thanks for your inputs. ... View more

Awesome, this worked. Thanks a ton @isoutamo  ... View more

Hi @anilchaithu  Thank you for response. Your suggestion certainly gives me the insight into Table B based on value from Table A. In my scenario, i have to lookup twice into Table B actually. Fist I will have to query Table B with JobID from Table A which gives me Agent Name. Second lookup into Table B is to query using Agent Name, Data and Hours where Hours needs to be taken from Table A record (Start time, End Time). This search will basically gives me list of events/jobs Agent was working on before Actual Job (Which is delayed). So for example, Table A JobID         Start Time                                                  EndTime 1234           2020-07-14 10:30:00                 2020-07-14 11:15:15 Table B AgentName      Date               Hour           JobID            JobStatus ABC                 2020--07-14    10              42242                  A XYZ                 2020--07-14    10              42212                 A ABC               2020--07-14    11              42215                 A RRR               2020--07-14    10              42218                 A ABC               2020--07-14    11             42213                 A ABC                2020--07-14    11              1234                 A In above example, JobID 1234 is delayed more than 10 minutes, so when we check Table B for that JobID, we can see Agent ABC has handled that job. Now if we look at Hours (Start Time, End Time) from Table A, it is 10:30 and 11:15 so we have to consider lower and higher side of hours which is 10 and 12. We now need to query Table B with Agent ABC , Date 2020-07-14 and Hours between 10 to 12 which will give results as below. AgentName      Date               Hour           JobID            JobStatus ABC                 2020--07-14    10              42242                  A ABC               2020--07-14    11              42215                 A ABC               2020--07-14    11             42213                 A ABC                2020--07-14    11              1234                 A In above results, i can see my job 1234 executed after 3 other jobs by the Agent ABC. This is the output I am expecting from my search. Any inputs or help is highly appreiciated.   Cheers.              ... View more

Thank you @isoutamo  As of now i have static data for 15 days ingested in the splunk to be analyzed and i am struggling with search query basically. Table A gives me orderID which took longer while table B gives me user who processed the order and also how many other task or activity for that user during that timeframe (from order came in to order processed). Can you please help me with search query for above case?     Thank You. ... View more

Hi @isoutamo  Thank you for your inputs. I am using DB connect and got the data from both tables into spunk. Table A has nearly 100000 records where Table B has more than 4 million records. Using data from table A where i can find how many orders took long time. Table B data will give me details like who (user) has served that order and what he (user) was doing (might have other orders, or any other reasons) between the time order came in and served. I need pointers to build search query for above scenario.   Thank You. ... View more