Splunk Search

Kicking different searches

yuwtennis
Communicator

Hi!

I want to ask question if something like below can be implemented.

I have created 4 searches.

search A : creates a CSV file with outputcsv
search B : creates a CSV file using the csv from search A
search C : creates a CSV file using the csv from search A
search D : creates a CSV file using the csv from search A

So the call flow would be like,

search A -> search B
-> search C
-> search D

search B - D has to be called the in the stream of search A.

Is this possible?

Thanks,
Yu

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You can use the fact that subsearches are run before the main search, so first of all run search A in a subsearch so that the CSV file exists, then use it in all your other searches.

searchB [search searchA | outputcsv ... | return ""] | outputcsv ... | append [search searchC | outputcsv ... ] | append [search searchD | outputcsv ... ]

View solution in original post

Ayn
Legend

You can use the fact that subsearches are run before the main search, so first of all run search A in a subsearch so that the CSV file exists, then use it in all your other searches.

searchB [search searchA | outputcsv ... | return ""] | outputcsv ... | append [search searchC | outputcsv ... ] | append [search searchD | outputcsv ... ]

yuwtennis
Communicator

Hello Ayn.

This looks nice. I will take a look at it.

Thanks,
Yu

0 Karma
Get Updates on the Splunk Community!

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

A Guide To Cloud Migration Success

As enterprises’ rapid expansion to the cloud continues, IT leaders are continuously looking for ways to focus ...