All Apps and Add-ons

Splunk DB Connect 2: How to get one search as input to another search in the same dbxquery?

tapptress
Explorer

All my data for this query is using DBX and one table.

I have to select Field A from DBname where Field B=open connection information
Then I need to match the Field A for the following (I only want the Field A values that appear from this query to run against):

select Field A, Field C from DBname where Field B=closed AND Field D > timevalue

Then I am just going to count by Field A Field B for some trending views

Essentially, I am looking at hosts with open tickets, then wanting to trend past outages for only those currently open hosts.

These both work independently.
I've tried subsearch, writing one of them to a lookup, but I'm just not skilled enough yet to figure out how to evaluate the two against each other.

I'd appreciate any suggestions. Thanks

0 Karma
1 Solution

tapptress
Explorer

I figured it out - just had to do a join - go figure.

View solution in original post

0 Karma

tapptress
Explorer

I figured it out - just had to do a join - go figure.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...