Splunk Search

Help with subsearches

jambajuice
Communicator

We are required to produce monthly audits of access to files that are covered by SOX. There are 8 groups of folders that we have to audit. Originally we were doing one search per folder and outputting the results to a csv file. I'd like to run a single search for the all of the file audit events and then use subsearches to output particular files to csv.

I've tried something like the search below and it gives me an error that subsearches can only be used as part of a command. What am I doing wrong?

host=jamba EventCode="560" Client_Domain="JUICE" Object_Name!="*.tmp" Object_Name="*\\*.*" Client_User_Name!="*$" Client_User_Name!="!*" | stats count(TimeWritten) as TimesAccessed by Object_Name Client_User_Name Accesses | [search "Folder1\\Folder2" | outputcsv AuditGroup1.csv] [search "Folder3\\Folder4 | outputcsv AuditGroup2.csv]

Thanks!

Tags (1)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

If the goal here is to produce several different CSV files, each containing some subset of the whole report, subsearches will not help you achieve that. Subsearches are mainly used for two purposes:

  1. Parametrize one search using the output of another search (for example, find me every record from IP addresses that visited some specific URL).
  2. Run a separate search but stitch the output to the first search (using the command | append []).

In this case, you're best off running one report per output file. In order to simplify management, I'd suggest using macros which allow you factor out the common elements of the searches.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...