Hi,
I need a way to check if a value is in a sub search table result.
for example I use the code that doesent work:
index=indexA groupID=*groupA* regression_target=*TargetA* job_type=run_job
| search
[ search index=indexA groupID=*groupA* regression_target=*TargetA* status=PASS job_type=batch
| dedup thumb_print
| fields thumb_print]
| table thumb_print
I am trying to filter the 'thumb_print' field by the subsearch result. in the subsearch there are more results then the whole search.
by the data, it does not make any sense. am I doing something wrong?
thanks
Hi matansocher,
You can try the query below:
index=indexA groupID=groupA regression_target=TargetA job_type=run_job OR (status=PASS AND job_type=batch)
| dedup thumb_print
| table thumb_print
Sorry, I didnt know that a subsearch has a timeout of 60 seconds or a limit of 50000 results.
Thanks anyway
hey @matansocher
index=indexA groupID=*groupA* regression_target=*TargetA* job_type=run_job
| search
[ search index=indexA groupID=*groupA* regression_target=*TargetA* status=PASS job_type=batch
| dedup thumb_print
| return 100000 thumb_print]
| table thumb_print
Use return command
http://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Return
100000 is the number of rows it can return.For a safer side put a high number. Also refer documentation for the same
Let me know if it helps!