Splunk Search

Where with subsearch

nkankur
Path Finder

Hi All,

I am trying correlate 2 different search queries using where with subsearch
it goes like this:

host="host1" | table Value1
above search give result : 40

host="host2" | where Value2<40
above search gives a list of events

But when I use above two in one search query like:
host="host2" | where Value2>[host="host1" | table Value1]

it's giving error : Error in 'where' command: Typechecking failed. The '<' operator received different types.

Kindly help!

0 Karma
1 Solution

somesoni2
Revered Legend

The subsearch is returning field name as well, hence it fails (your where clause becomes | where Value2>Value=40). Try any of below

host="host2" | where Value2>[host="host1" | table Value1 | return $Value1]

OR

host="host2" | where Value2>[host="host1" | table Value1 | rename Value1 as search]

View solution in original post

somesoni2
Revered Legend

The subsearch is returning field name as well, hence it fails (your where clause becomes | where Value2>Value=40). Try any of below

host="host2" | where Value2>[host="host1" | table Value1 | return $Value1]

OR

host="host2" | where Value2>[host="host1" | table Value1 | rename Value1 as search]

View solution in original post

nkankur
Path Finder

Thanks a lot! It worked!

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!