Splunk Search

Putting two search queries within and

aseid
New Member

Out of concern for performance, I need to put more than one search queries within same <query> and </query> block. One search query feeds the next using lookup writes and reads. Can I do that?

Tags (3)
0 Karma

mmensch
Path Finder

Have you tried using an append command or using a subsearch?

Append Splunk Doc: http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Append

SubSearch Splunk Doc: http://docs.splunk.com/Documentation/Splunk/6.2.4/Search/Aboutsubsearches#A_subsearch_example

You can also control the subsearch with settings in limits.conf for the runtime and maximum number of results returned.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If output of one search is input for 2nd one, you can just merge them into one big search.

0 Karma

aseid
New Member

I designed one 'big' search query but at the cost of performance (and elegance). Reason being two chunks of the search must be re-used twice implying that the search must be re-launched.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The thing you want to achieve requires sequencing of search queries as the lookup from 1st query should be populated before 2nd query should start. If the timerange/data for 1st query doesn't change very much drastically, you can schedule it to run frequently and update the lookup file. The 2nd query will just get the data from the latest scheduled run of the 1st query. Thoughts?

0 Karma

bmacias84
Champion

Why not use post process searches.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...