Splunk Dev

Nested Search Query

kartiksha
Explorer

Hi,

I need a way to merge these two queries to get a proper report with having to run them separately.

First Query to generate a list of IDs:
source="Source1" receiverAddress=test@test.com| dedup "attachments{}.UniqueID"|table "attachments{}.UniqueID"

Results (EX):
1e32fdc2-5519-4e3a-2233-88e49a21e663

Second Query to generate actual results:
source="Source2" UniqueID=1e32fdc2-5519-4e3a-2233-88e49a21e663 CreateEvent|dedup UniqueID| timechart span=1d count(UniqueID) as "Test"

Results (EX):
_time Test
2017-05-29 1

I tried to use Nested Query like:
source="Source2" [search source="Source1" receiverAddress=test@test.com| dedup "attachments{}.UniqueID"|table "attachments{}.UniqueID"] CreateEvent|dedup UniqueID| timechart span=1d count(UniqueID) as "Test"

But unfortunately it returns nothing. Is there something I'm doing incorrectly?

Thanks
Kartik Sharma

Tags (1)
0 Karma
1 Solution

DalJeanis
SplunkTrust
SplunkTrust

You basically had it, except for one thing. compare these two points...

 ...| table "attachments{}.UniqueID"  ]...

and

 ... UniqueID=1e32fdc2-5519-4e3a-2233-88e49a21e663 ...

If you rename the first fieldname to be the same as the second, then it should work. Test it first with head 1 to save on run time, as below...

index=foo source="Source2" 
    [ search index=bar source="Source1" receiverAddress=test@test.com 
    | dedup "attachments{}.UniqueID" 
    | rename "attachments{}.UniqueID" as UniqueID 
    | head 1 
    | table UniqueID]  
   CreateEvent
| dedup UniqueID
| timechart span=1d count(UniqueID) as "Test"

I'm not familiar with "CreateEvent" - if that is a macro, there should be a tickmark in front of it, and we would have to investigate the code to make sure it would work in that spot with with multiple records. If it is a fieldname, then CreateEvent=* would be more descriptive. If it is a literal, then quotes around it would be better practice.

if it is a macro, then get a second unique id and try this first -

source="Source2" (UniqueID=1e32fdc2-5519-4e3a-2233-88e49a21e663 OR UniqueID=SomeOtherIdThatIsThere) CreateEvent|dedup UniqueID| timechart span=1d count(UniqueID) as "Test"

View solution in original post

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

You basically had it, except for one thing. compare these two points...

 ...| table "attachments{}.UniqueID"  ]...

and

 ... UniqueID=1e32fdc2-5519-4e3a-2233-88e49a21e663 ...

If you rename the first fieldname to be the same as the second, then it should work. Test it first with head 1 to save on run time, as below...

index=foo source="Source2" 
    [ search index=bar source="Source1" receiverAddress=test@test.com 
    | dedup "attachments{}.UniqueID" 
    | rename "attachments{}.UniqueID" as UniqueID 
    | head 1 
    | table UniqueID]  
   CreateEvent
| dedup UniqueID
| timechart span=1d count(UniqueID) as "Test"

I'm not familiar with "CreateEvent" - if that is a macro, there should be a tickmark in front of it, and we would have to investigate the code to make sure it would work in that spot with with multiple records. If it is a fieldname, then CreateEvent=* would be more descriptive. If it is a literal, then quotes around it would be better practice.

if it is a macro, then get a second unique id and try this first -

source="Source2" (UniqueID=1e32fdc2-5519-4e3a-2233-88e49a21e663 OR UniqueID=SomeOtherIdThatIsThere) CreateEvent|dedup UniqueID| timechart span=1d count(UniqueID) as "Test"
0 Karma

kartiksha
Explorer

Hi,

It worked. Thanks for your support DalJeanis. I now need to work on more advanced dashboard so would come back if further queries.

Thanks
Kartik Sharma

DalJeanis
SplunkTrust
SplunkTrust

Great!

So, for my curiosity and everybody's edification, what was CreateEvent?

0 Karma

kartiksha
Explorer

Ahhh... that please ignore. It was a dummy query and I just used one of the keyword from our logs 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...