topic use a result value, as fieldname in subsearch in Splunk Search

use a result value, as fieldname in subsearch

sbsbb — Mon, 28 Sep 2020 14:41:58 GMT

I have a first search, that return "system1"

Then I want to use that value, to get the appropriate value out of a subsearch timechart :

first restult :
system
system1

second result :
system1 system2 system3
_time 1 2 3
_time 4 5 4
_time 4 4 4

How could I do that ?
is there a way to put the first result in a parameter, that could be used in the subsearch as fieldname ?

index=myfirstquery | table system | subsearch [ _time=$_time$ | eval myValue=fieldName[$system$]]

Re: use a result value, as fieldname in subsearch

Ayn — Mon, 02 Sep 2013 13:08:10 GMT

You can never pass variables from outer searches to subsearches, because subsearches run before outer searches and as such cannot read values that haven't been extracted/evaluated in the outer searches yet.

Re: use a result value, as fieldname in subsearch

kristian_kolb — Mon, 02 Sep 2013 13:59:22 GMT

I think you might be able to turn it around, making the so-called first search the subsearch;

second_search_terms [search first_search_terms | dedup system | fields + system] | further_processing

search_terms would be stuff like earliest / latest, index, sourcetype etc.

The idea is that the inner search will (via the fields + command) only return the field system, so that the outer search will effectively look like;

second_search_terms (system=aaa OR system=bbb or system=ccc) | further_processing

I think that this is what you're after.

EDIT: Fixed a typo

Re: use a result value, as fieldname in subsearch

sbsbb — Tue, 03 Sep 2013 05:23:25 GMT

I'm not sure if this is bringing me further, where did you pass the fieldname to the second search part ?
If one of the search is returning "system1" as result, I have to read the content of the "system1" field in the second part...

Re: use a result value, as fieldname in subsearch

Ayn — Tue, 03 Sep 2013 07:24:11 GMT

Read up on how subsearches work. http://docs.splunk.com/Documentation/Splunk/5.0.2/Tutorial/Useasubsearch

Re: use a result value, as fieldname in subsearch

sbsbb — Thu, 05 Sep 2013 11:37:31 GMT

I know pretty well how subsearch work, that doesn't help, but maybe is return what I'm searching for
http://docs.splunk.com/Documentation/Splunk/5.0.4/SearchReference/Return

I think change subsearch order like Kristian suggested + return function should do the job

Re: use a result value, as fieldname in subsearch

kristian_kolb — Thu, 05 Sep 2013 12:41:07 GMT

well, return and fields are pretty similar in effect