Splunk Search

"Unknown search command" with subsearch

chrlshrnbrgr
New Member

I'm stumbing over subsearches.

In our system, app server logs contain an SID (session ID). It's trivial to find all (valid/known) SIDs for a given account with:

SID!=SID_UNKNOWN sourcetype=unicorn account="customer@example.com" | top SID | table SID 

I can also break down the status codes easily:

sourcetype=unicorn HTTP_CODE>=400 | top HTTP_CODE

But I can't figure out how to put the two together using a subsearch. If I try:

sourcetype=unicorn HTTP_CODE>=400 | top HTTP_CODE [ SID!=SID_UNKNOWN sourcetype=unicorn account="customer@example.com" | top SID | table SID ]

I get:

Unknown search command 'sid'.

What am I missing here?

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

You need to call a command first, such as "search". For the main query that is prepended by default. Something like this:

... [search SID=...

I'm not sure what you want to do though, since you're passing the result of the subsearch to the top command, which doesn't support this.

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

top limit=1000 or top limit=0, but yes, dedup is better if you don't need the ranking and percentages, since it doesn't have to sort or accumulate the total.

0 Karma

jonuwz
Influencer

"It's trivial to find all" - top does not return all the SIDS.

[ ... | fields SID | dedup SID ]

will

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

You need to call a command first, such as "search". For the main query that is prepended by default. Something like this:

... [search SID=...

I'm not sure what you want to do though, since you're passing the result of the subsearch to the top command, which doesn't support this.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

You don't the | at the start of the subsearch. It's implicit, which is why there's an error in the first place.

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Take a look at the return command in the splunk docs as well.

0 Karma

chrlshrnbrgr
New Member

Thanks, I figured out the same by looking thru other questions tagged with subsearch. Here's what I ended up with:

sourcetype=unicorn HTTP_CODE>=400 [ | search SID!=SID_UNKNOWN sourcetype=unicorn account=customer@example.com | top SID | table SID ] | top HTTP_CODE
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...