Hi,
We used to append saved search results as following without problem:
| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | append [|savedsearch Test_VPN_log_stats ]
However, when same saved search is used, e.g.
| savedsearch Test_VPN_log_stats| append [|savedsearch Test_VPN_log_stats ]
We'll get error like this:
Error in 'SearchParser': Found circular dependency when expanding savedsearch=Test_VPN_log_stats
Would like to know if it's possible to:
pass fields from the first saved search to the appending ones, e.g. IPAddr and UserName are 2 of the resulting field from saved search Test_RADIUS_report:
| savedsearch Test_RADIUS_report ipaddr="" username="Amuro" | append [|savedsearch Test_RADIUS_report ipaddr=$IPAddr username="" ] |append [| savedsearch Test_RADIUS_report ipaddr="*" username=$UserName ] | more append ....
Sorry that I've old school thinking and and hope savedsearch can be used as function call that can be called recursively.
Would anyone please help?
Thanks a lot.
Regards
You might be able to use selfjoin
(http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Selfjoin) but better yet, try multireport
(no docs on this yet), like this:
| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro"
| multireport
[| stats count BY host]
[| stats count BY sourcetype]
[| stats count BY server]
Or multisearch
, like this:
| multisearch
[| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=1]
[| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=2]
[| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=3]
| stats count BY set
You might be able to use selfjoin
(http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Selfjoin) but better yet, try multireport
(no docs on this yet), like this:
| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro"
| multireport
[| stats count BY host]
[| stats count BY sourcetype]
[| stats count BY server]
Or multisearch
, like this:
| multisearch
[| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=1]
[| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=2]
[| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=3]
| stats count BY set
That's helpful. Thanks a lot.