- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: How to only return results where values for a ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello all,
I'm somewhat new to Splunk as a consistent user and am trying to master the magic of subsearches. I come from a SQL background and am looking to replicate the function of a correlated sub-query using a composite key. I can get simple subsearches to work, but I can't seem to understand more complex scenarios where matching the two datasets on two keys is necessary.
I have two working searches which work independently and I'm hoping I can get a good working example as a model.
UserName=Bob OR UserName=Eduardo earliest=-3d latest=-2d | table UserName EmpNum ComputerName
Bob | 1234 | File_Server.domain.com
Eduardo | 4567 | File_Server.domain.com
Bob | 1234 | Web_Server.domain.com
Eduardo | 4567 | Web_Server.domain.com
Eduardo | 4567 | Email_Server.domain.com
UserName=Bob OR UserName=Eduardo earliest=-1d latest=now()| table UserName EmpNum ComputerName
Bob | 1234 | File_Server.domain.com
Eduardo | 4567 | File_Server.domain.com
Bob | 1234 | Web_Server.domain.com
Eduardo | 4567 | Web_Server.domain.com
Eduardo | 4567 | Email_Server.domain.com
Bob | 1234 | Print_Server.domain.com
Essentially I need to find from a subsearch where ComputerName from list 2 does NOT exist in list 1 for the user / empnum combination. Therefore, I would expect output as:
Bob | 1234 | Print_Server.domain.com
Is it as simple as just concatenating the keys together in both sides? (e.g. UserName.Empnum) If so, how do I indicate to Splunk to use the derived field?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
UserName=Bob OR UserName=Eduardo earliest=-3d latest=-2d NOT [search UserName=Bob OR UserName=Eduardo earliest=-1d latest=now() | fields UserName EmpNum ComputerName]| table UserName EmpNum ComputerName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
UserName=Bob OR UserName=Eduardo earliest=-3d latest=-2d NOT [search UserName=Bob OR UserName=Eduardo earliest=-1d latest=now() | fields UserName EmpNum ComputerName]| table UserName EmpNum ComputerName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Does Splunk just automatically know to map the sub-search to the main search based off of field names?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
YES! Splunk is so cool! To see exactly what it does, take your subsearch, run it as the main search and tack on | format to the end of it.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
