https://community.splunk.com/t5/Splunk-Dev/Using-data-model-inside-subsearches/m-p/410729#M7113 <P>*this answer means <A href="https://answers.splunk.com/answers/151315/how-to-find-differences-between-two-searches-with-set-diff-command.html">https://answers.splunk.com/answers/151315/how-to-find-differences-between-two-searches-with-set-diff-command.htm</A>l</P> Fri, 25 May 2018 10:22:14 GMT adrab 2018-05-25T10:22:14Z https://community.splunk.com/t5/Splunk-Dev/Using-data-model-inside-subsearches/m-p/410728#M7112 <P>Hello,<BR /> I'm working on analysis of data coming from some web scan app. <BR /> I have to compare the results from two scan executions. Inspired by <A href="https://answers.splunk.com/answers/151315/how-to-find-differences-between-two-searches-with-set-diff-command.html" target="_blank">this answer</A> I've got this working:</P> <PRE><CODE>| set diff [search index=webscan sourcetype=webscan message="Done exchange {exchange}" scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T20:59:18| stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] [search index=webscan sourcetype=webscan message="Done exchange {exchange}" scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T18:57:32 | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] </CODE></PRE> <P>The problem appears when I try to use a data model in subsearches - the following does not work (shows "No results found"):</P> <PRE><CODE>| set diff [| datamodel WebScan Exchanges search | search scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T20:59:18| stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] [| datamodel WebScan Exchanges search | search scanId=110cf971-c319-41dc-b58c-670f4c141cf1 execId=2018-05-24T18:57:32 | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url] </CODE></PRE> <P>in spite of the fact that subsearches run separatly works as expected.<BR /> What should be changed?</P> <P>Ultimately, I would like to define a macro <EM>exchanges_of(2)</EM> like </P> <PRE><CODE>datamodel WebScan Exchanges search | search scanId=$scanId$, execId=$execId$ | stats count by eventProperties.exchange.PluginId, eventProperties.exchange.Url | table eventProperties.exchange.PluginId, eventProperties.exchange.Url </CODE></PRE> <P>and do this:</P> <PRE><CODE>| set diff [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1, 2018-05-24T20:59:18)`] [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1,2018-05-24T18:57:32)`] </CODE></PRE> <P>but this also returns "No results found."</P> <P>And it would be great if I could do something like</P> <PRE><CODE>| `exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1, 2018-05-24T20:59:18)` NOT [|`exchanges_of(110cf971-c319-41dc-b58c-670f4c141cf1,2018-05-24T18:57:32)`] </CODE></PRE> <P>for "one side" diff. Is it possible?</P> Tue, 29 Sep 2020 19:37:59 GMT https://community.splunk.com/t5/Splunk-Dev/Using-data-model-inside-subsearches/m-p/410728#M7112 adrab 2020-09-29T19:37:59Z https://community.splunk.com/t5/Splunk-Dev/Using-data-model-inside-subsearches/m-p/410729#M7113 <P>*this answer means <A href="https://answers.splunk.com/answers/151315/how-to-find-differences-between-two-searches-with-set-diff-command.html">https://answers.splunk.com/answers/151315/how-to-find-differences-between-two-searches-with-set-diff-command.htm</A>l</P> Fri, 25 May 2018 10:22:14 GMT https://community.splunk.com/t5/Splunk-Dev/Using-data-model-inside-subsearches/m-p/410729#M7113 adrab 2018-05-25T10:22:14Z