foreach and subsearch values

splunk_new1 — Mon, 22 Feb 2021 17:49:36 GMT

I am using a table of results

 a |   b |  c |   search           | d |    e  
===============================================
xx    yy   zzz   index=firstindex    bb    ppp 
yyy  qqq  eeee   index=secondindex   rr    sss
ttt  zxc  asd    index=thirdindex    uy    mmm

based on each result, I would like to perform a foreach command to loop through each row of results based on the "search" field and perform a subsearch based on the VALUES in the "search" field, from a coding's perspective it would be something like

for each row: 

if field= search: 
      #use value in search
      [search value | return index to main search]

it should evaluate to something like this for each row 

if field=search:
      [search index=index1 | return index]

My desired output is:

index  
==============  
firstindex
secondindex
thirdindex

Is this possible? I have tried using

foreach * [eval if <<FIELD>>=="search"[search <<FIELD>>] ","[search <<FIELD>>]]

but this does not seem to work.

I am aware of the map command, however as my field results have the word index= before the actual index name, I am unable to do a

search
========================
index=firstindex   
index=secondindex
index=thirdindex

|map search="search index=$search$"

as I believe ^ would resolve to map search="search index=index=firstindex "

This would be an error. Is there anyway I can do something like

|map search="search $search$| stats values(index)"

and have it return something like 

index
==========
firstindex
secondindex
thirdindex

Tried looking around in splunk community forums but they seem to point at map instead of foreach, I am really lost in how I can get around this issue and achieving my desired output, it would be great if someone with more splunk experience can assist me

Re: foreach and subsearch values

richgalloway — Tue, 23 Feb 2021 13:40:24 GMT

The map command can be made to work, but it's overkill for this situation. Just extract the index name from the search field using rex.

... | rex field=search "=(?<indexName>.*)" | ...

Re: foreach and subsearch values

splunk_new1 — Tue, 23 Feb 2021 02:45:22 GMT

Ah, appreciate this, I have tried it but it does not seem to work..

As the search field values may contain more than just one index, it does not seem to be possible, it would be ideal if the entire search field values can be just passed into the search itself as this is the search query.

search

=============
index=index1

index=index2

index=index3
index=(index1 OR index2 OR index3) sourcetype=blahblah
index=`test`

topic Re: foreach and subsearch values in Splunk Search

foreach and subsearch values

Re: foreach and subsearch values

Re: foreach and subsearch values