Splunk Search

Pass one field from multiple fields returned by subsearch

Murali2888
Communicator

Hi All,

I have a search query like below.

[search A | fields B,C] | search (D OR E) | fields F | table, B,C,F.

Search A returns two fields.
I need to pass the field C to the master search but still want to retain the field B for the final results.
The above query passes both fields B & C to the master search and hence the master search is not return any results.

Is there possible solution for this?

Thanks
Murali

0 Karma

pacrip
Path Finder

Hi Murali

I had alot of issues with my subsearches but i found the best way to get back multiple fields from from a subsearch was using Eval (making sure the results are returned using a field called 'query' (dont ask me why)) and then rexing out your fields from the result. Its not very elegant but it gives you visibility and control over the data you are returning.

Im not very good at written explanations so maybe a code example would help:

eval f=[search A | fields B,C | eval query=B+";"+C | table query ] | rex (insert splitting regex here) | search (D OR E) | fields F | table, B,C,F
0 Karma

Ayn
Legend

No. The subsearch emits a filter string containing all values for B and C. There's no separate "channel" where field values can be returned from a subsearch without having them emitted as a filter string. Depending on your exact scenario, you might want to look into using join, or if you have fairly static data, consider putting your B values in a lookup.

0 Karma

Murali2888
Communicator

thanks @Ayn. I have been using join till now for this query but that has performance impact, so I am exploring other options.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...