Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to join two searches that have two common fields and put a condition on one of the common fields?

$
0
0
I want to do a join of two searches that have a common field ID and time, but I want to have a condition on time when IDs match. Consider two tables user-info and some-hits user-info name ipaddress time user1 20.20.20.20 t0 user2 20.20.20.20 t1 user1 30.30.30.30 t2 some-hits ipaddress hits time 20.20.20.20 10 t0.03 20.20.20.20 40 t0.03 20.20.20.20 46 t0.9 30.30.30.30 60 t1 30.30.30.30 78 t1.5 Here I want to match all records from some-hits with user-info whose ipaddress match, but some-hits.time < user-info.time So t0.03 should match with t0 . t0.9 should match with t1. t1 and t1.5 should match with t2. I wanted to know how I can use join to achieve this? Thanks

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>