topic Re: Subserch - trying to use results from subsearch as an input on the main one. in Splunk Search

Subserch - trying to use results from subsearch as an input on the main one.

dabroma5 — Fri, 03 Apr 2020 12:34:25 GMT

Hi,

I am trying to filter input and output with :
2020-03-31 09:57:11,714 9.5.1455: ERROR syslog156: operation failed for (28, 325). Status codes: 'blablabla'

host="main"   source="main.log"  ERROR syslog*
    | rex "(?=[\(](?<input>\d+)[,])"
    | rex "(?=[, ](?<output>\d+)[\).])"

and later find id with (on log line input is separated from output with 'to')
2020-03-31 09:57:11,020 9.5.1455: INFO syslog890: Should connect/disconnect 28 to 325 for 1.1.8.4.58.1 with operation absolute

host="main"   source="main.log"  INFO syslog*  input "to" output
        | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
        | table _time  id

the complete query looks like that:

  host="main"   source="main.log"  INFO syslog* input "to" output
    | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
    | table _time  id
    [search host="main"   source="main.log"  ERROR syslog*
    | rex "(?=[\(](?<input>\d+)[,])"
    | rex "(?=[, ](?<output>\d+)[\).])"]

2020-03-31 09:57:11,020 9.5.1455: INFO syslog890: Should connect/disconnect 28 to 325 for 1.1.8.4.58.1 with operation absolute
2020-03-31 09:57:11,714 9.5.1455: ERROR syslog156: operation failed for (28, 325). Status codes: 'blablabla'

Re: Subserch - trying to use results from subsearch as an input on the main one.

richgalloway — Fri, 03 Apr 2020 13:49:33 GMT

A subsearch should use the fields command to specify which fields are to be passed back to the main search. You may also need format to put those fields into a format that is syntactically correct for the main search.

Re: Subserch - trying to use results from subsearch as an input on the main one.

dabroma5 — Wed, 30 Sep 2020 04:52:56 GMT

I have added | fields input, output:

  host="main"   source="main.log"  INFO syslog* | fields input, output
     | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
     | rex "(?:disconnect )(?<input_info>\d+)"
     | rex "(?:to )(?<output_info>\d+)"
     | table _time  id
     [search host="main"   source="main.log"  ERROR syslog*
     | rex "(?=[\(](?<input>\d+)[,])"
     | rex "(?=[, ](?<output>\d+)[\).])"]

but still, it doesn't work as I expected.
I would like to use results from first filtering and use it as a base on filtering on the second query. Something like:
if input==input_info AND output==output_info:
than: table _time id

Re: Subserch - trying to use results from subsearch as an input on the main one.

richgalloway — Mon, 06 Apr 2020 12:23:01 GMT

The fields and format commands should be in the subsearch (the one within []). Subsearches execute before the main search. The results of the subsearch then become part of the text of the main search.

Re: Subserch - trying to use results from subsearch as an input on the main one.

dabroma5 — Mon, 06 Apr 2020 13:20:41 GMT

Sorry, I didn't catch, can you please rewrite my query with your fixes

Re: Subserch - trying to use results from subsearch as an input on the main one.

richgalloway — Wed, 08 Apr 2020 12:20:26 GMT

host="main"   source="main.log"  INFO syslog* 
    [ search host="main"   source="main.log"  ERROR syslog*
      | rex "(?=[\(](?<input>\d+)[,])"
      | rex "(?=[, ](?<output>\d+)[\).])"
      | fields input, output | format ]
    | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
    | rex "(?:disconnect )(?<input_info>\d+)"
    | rex "(?:to )(?<output_info>\d+)"
    | table _time  id

Re: Subserch - trying to use results from subsearch as an input on the main one.

dabroma5 — Thu, 09 Apr 2020 12:16:08 GMT

Still doesn't work.
Maybe I wasn't enough specific about my goal.
From the subsearch I am receiving two ID's (input, output). I would like to use them as values to filter the main search and find id_mrp correlated with both: input and output.

Re: Subserch - trying to use results from subsearch as an input on the main one.

richgalloway — Thu, 09 Apr 2020 12:30:30 GMT

The subsearch is returning a search string in the form (input=foo OR output=bar). Perhaps that is not the right format for your main search. Let's try another method. This is the general form for one way of combining two searches. The problem is there is no common field between the two searches to use for grouping by the stats command. I'll let you find the common field and update the query.

host="main"   source="main.log"  INFO syslog* 
| rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
| rex "(?:disconnect )(?<input_info>\d+)"
| rex "(?:to )(?<output_info>\d+)"
| append [ search host="main"   source="main.log"  ERROR syslog*
       | rex "(?=[\(](?<input>\d+)[,])"
       | rex "(?=[, ](?<output>\d+)[\).])" ]
| stats values(*) as * by id
| table _time  id