Saved search table value as array for multi-valued search to a new table

jsleona — Sun, 27 Aug 2017 15:17:21 GMT

Hello I am doing a search that results in a table with these values... "| table _time, recState, context, message.connID, message.timeStamp.timeinSecs, message.agentID, message.aNI, host"

The issue is that I need to know durations which is not captured in the events. But I can do... "index=abc sourcetype=xyz message.connID | stats range(_time) as difference". Which provides an individual view of the events with this one unique ID and provides overall event duration.

I am trying to find a way to use the initial table as array values, run multiple searches like the one above, to produce a new table where each row has all the table columns and a new column for "duration" based one each unique message.connID.

Re: Saved search table value as array for multi-valued search to a new table

DalJeanis — Mon, 28 Aug 2017 05:32:24 GMT

@jsleona - If you had given us the entire original search, then we could provide a complete solution. I have provided a solution below that uses your given table to get the rest, but it would be much more efficient to get it all in a single pass at the data.

For instance, here's a way to get all the differences, by themselves, at the same time...

index=abc sourcetype=xyz   [your search that gets all that stuff | table message.connID]
| stats range(_time) as difference by message.connID

...and here's a way to get it after your existing search and attach it to your existing search...

 your search that gets all this stuff
 | table _time, recState, context, message.connID, message.timeStamp.timeinSecs, message.agentID, message.aNI, host
 | appendpipe 
     [| table message.connID 
      | format 
      | rename search as mysearch 
      | map search="search index=abc sourcetype=xyz $mysearch$ 
      | stats range(_time) as difference by message.connID 
      ]
 | eventstats max(difference) as difference by message.connID

... however, while that method will almost certainly work, it is also almost certainly not the most efficient way.

topic Saved search table value as array for multi-valued search to a new table in Splunk Dev

Saved search table value as array for multi-valued search to a new table

Re: Saved search table value as array for multi-valued search to a new table