topic Re: Splunk query response in Splunk Dev

How to retrieve specific Splunk query response

msg4sunil — Thu, 28 Apr 2022 18:07:13 GMT

Team,

index sourcetype=app_* some_search | rex "\[(?<transactionid>[A-Za-z0-9]+)\]" | rename transactionid as q|table q|format

returns me

( ( q="100223608103" ) OR ( q="D202204021000676" ) )

How do I get the below instead?

( ( "100223608103" ) OR ("D202204021000676" ) )

Thank you

Re: Splunk query response

bowesmana — Thu, 28 Apr 2022 07:54:31 GMT

Not exactly what you want, but replace format with

| return 999 $q

that will give you

(100223608103) OR (D202204021000676)

Re: Splunk query response

ITWhisperer — Thu, 28 Apr 2022 07:56:01 GMT

| rename transactionid as query

Re: Splunk query response

bowesmana — Thu, 28 Apr 2022 07:59:40 GMT

I always forget 'query' keyword

Here's the doco on those keywords

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2202/Search/Changetheformatofsubsearchresults

Re: Splunk query response

msg4sunil — Thu, 28 Apr 2022 08:04:17 GMT

Lovely thank you. Just now figured out that even the below works

| rename transactionid as search

Source: https://docs.splunk.com/Documentation/SplunkCloud/latest/Search/Changetheformatofsubsearchresults

The following search looks for a value in the clID field that is associated with a name token or field value. The clID value is then used to search for several sources.

index=myindex [search index=myindex host=myhost MyName | top limit=1 clID | fields clID ]

The subsearch returns the field and value in the format: ( (clID="0050834ja") )

To return only the value, 0050834ja, rename the clID field to search in the subsearch. For example:

index=myindex [search index=myindex host=myhost MyName | top limit=1 clID | fields clID | rename clID as search ]

When the field is named search or query, the field name is dropped and the implicit | format command at the end of the subsearch returns only the value.

If you return multiple values, such as specifying ...| top limit=3, the subsearch returns each of the values with the boolean OR operator between the values. For example, if the previous search example used ...| top limit=3, the values returned from the subsearch are ( ( value1 ) OR ( value2 ) OR ( value3 ) ).