Splunk Search

Subsearch not Working

Makinde
New Member

I believe I fully understand the concept of subsearches and have used it a few times perfectly, however, I can't get it to work in this instance.

Below is my search string;

index=main sourcetype="linux:audit" [ search index=main sourcetype="linux:audit" key=CFG_Oracle | return msg ] 

The idea here is to search index=main and sourcetype=linux:audit, for any event with key=CFG_oracle, then for those events return the values of the msg field after which the msg values should be searched in index=main and sourcetype=linux:audit and return those events.

However when I run this search, I get all events with keys other than CFG_Oracle, however when I tun the sub-search on it's own I get the desired result, I am not sure why this isn't working properly as a sub-search.

Any ideas?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=main sourcetype="linux:audit" [ search index=main sourcetype="linux:audit" key=CFG_Oracle | stats count by msg | table msg]

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=main sourcetype="linux:audit" [ search index=main sourcetype="linux:audit" key=CFG_Oracle | stats count by msg | table msg]
0 Karma

Makinde
New Member

Thanks Somesoni2

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...