Splunk Search

subsearches do not work after upgrade.

Genti
Splunk Employee
Splunk Employee

We were on 3.4.6 and I think subsearches worked fine. We upgraded to 4.0.10 and they broke. So I upgraded to 4.1.1, and they're still broken. It might be something in limits.conf, but we're pretty close to default there.

eventtype=abc mailto=xyz

returns 4 results.

eventtype=abc mailto=xyz | fields + mid|format

returns those same results as ((mid="1") OR (mid="2") OR (mid="3") OR (mid="4"))

eventtype=abc [search eventtype=abc mailto=xyz | fields + mid]

or anything with a subsearch returns no results. The Cisco E-Mail Security Form Search from the cisco_esa_addon app does a search similar to this and returns nothing.

any ideas?

TIA, .gz

Tags (3)

gkanapathy
Splunk Employee
Splunk Employee

trying to be more clear, is the value of mid a word by itself in the raw text, or is it a part of a word in the raw text?

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

oh, if it's not too much trouble, can you tell us how mid is extracted? more specifically, are the values of mid delimited on each side by non-word character? e.g., if mid is 2, is it extracted from xxx, 2, yyy or is is more like xxx, n2, yyy or even xxx, n2m, yyy?

0 Karma

sideview
SplunkTrust
SplunkTrust

I recommend also running the search and then doing

Actions > Inspect Search

you'll see a page with lots of strange data on it. Scroll down to find the 'remoteSearch' entry. The search you'll see there will have some very strange looking characteristics. You'll see some weird 'litsearch' commands and it'll look a little weird. However it will also have expanded all the eventtypes, and it will also have the basic terms that came out of your subsearch.

Take a look at that and that may help.

gkanapathy
Splunk Employee
Splunk Employee

Can you try:

eventtype=abc [search eventtype=abc mailto=xyz | fields + mid | fields - _* ]

and see if that works?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...