Using sub-queries with conditions other than equals / match in Sumo


1 comment

  • Avatar
    Olaf Stein

    Subquery is a correlation method, matching values from the child and parent query, correlating on things like usernames, ip's, session id's etc. It allows us to find a subset of data based on the result of another query, matching the same values.

    No < (or >) or = operation is possible here. Other correlation operators have the same constraint.

    In this case you could try bringing in both datasets via OR:

    (_sourceCategory="A" OR _sourceName = "Log" _sourceCategory="B" "filtertext" )

    //parse fields for both sets of data (use bnodrop)

    | first(_messagetime) by FIELDS, _sourceCategory



    Comment actions Permalink

Please sign in to leave a comment.