Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Alternative for join.

$
0
0
index=core a=BuilderService AND "decision.received" "Overrides" NOT "ItemOverrides=()" NOT commitCode=null | rename Orderid as data.Orderid | join data. Orderid [ search index=transaction "mileStoneId"=SESSION_CREATE | rename commitCode as CommitCodeAtSessionCreate] | join data. Orderid [ search index=transaction "mileStoneId"="ORDER_RELEASE" | rename commitCode as CommitCodeAtWebOrderRelease] | table data.Orderid,CommitCodeAtSessionCreate,commitCode,data.webOrderNumber,CommitCodeAtWebOrderRelease | rename commitCode as OverridenCommitCode I am trying to print commitCode at different stages of order placement.This works but, I just don't want to use join. Thanks for your time.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>