Splunk Search

saving result of a search query to a variable in order to use in another search

nimakaveh
Explorer

I have a query like below and I want to compare the result of avg1 with each day result and specify if it is normal or alert. However; this result doesn't work because avg1 is not saved to use in my sub search.

host="neb1" status="authentication failure" earliest=-30d |stats count by date_mday | stats avg(count) as avg1| append [search host="neb1" status="authentication failure" | stats count by date_hour] | eval Description=case(count<=avg1, "Normal", count>avg1, "Alert")

I would really appreciate your help.

Tags (1)
0 Karma
1 Solution

bmacias84
Champion

This command you are looking for is return.

additional reading:

Return

Hope this helps or gets you started. Dont forget to vote and accept answers that help.

View solution in original post

bmacias84
Champion

This command you are looking for is return.

additional reading:

Return

Hope this helps or gets you started. Dont forget to vote and accept answers that help.

nimakaveh
Explorer

thanks for your help.

0 Karma

bmacias84
Champion

eventstats should be appended to event after stats.

bmacias84
Champion

not quite sure what you trying to really accomplish. I might even use join or eventstats. I am doing this off the cuff.
host="neb1" status="authentication failure" earliest=-30d |stats count by date_hour,date_mday | eventstats avg(count) as avg1 by date_mday | eval Description=case(count<=avg1, "Normal", count>avg1, "Alert")

nimakaveh
Explorer

Hi thanks for your reply. Can you please modify my query with adding "return" as you said?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...