topic Re: stuck on a subsearch in Splunk Search

stuck on a subsearch

dbcase — Mon, 07 May 2018 19:59:35 GMT

Hi,

I have this query, what I'm trying to do is pull the mac address out of events with a 405 error dedup them then put them in a table. Then taking that table search the same index and match on mac address and pull out the external account id and finally put the mac address and external account id in a table. I can break apart the query and it seems to work, just not working when I put it together. Thoughts?

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|table extref|where len(extref)<10|table mac extref

Re: stuck on a subsearch

dbcase — Mon, 07 May 2018 20:19:47 GMT

failed attempt #2

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac

Re: stuck on a subsearch

somesoni2 — Mon, 07 May 2018 20:27:40 GMT

Try this

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*"|rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"  | search [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac

Re: stuck on a subsearch

dbcase — Mon, 07 May 2018 20:32:29 GMT

ahhhh search then [search

Thanks Somesoni2!!!

Re: stuck on a subsearch

dbcase — Mon, 07 May 2018 20:33:04 GMT

Can you convert to answer?