https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294469#M160391 <P>So the $drop_name$ and $test_name are the user input tokens (dropdown or textbox I'm guessing)? Why do you need a subsearch for that if you just want user to filter records based on their inputs.. Something like this should work just fine. (assuming $drop_name$ gives you column name (index/sourcetype/description) and $text_name$ gives the values to be searched)</P> <PRE><CODE>| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | where '$drop_name$'="$text_name$" AND match(description,"$text_name$") | mvcombine sourcetype | sort index | table index sourcetype description </CODE></PRE> Tue, 29 Sep 2020 14:45:21 GMT somesoni2 2020-09-29T14:45:21Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294466#M160388 <P>Hi everyone. How do I format this subsearch to work in my search query? I'm still fairly new to splunk</P> <PRE> | inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | search "$drop_name$"="$text_name$*" [search "$drop_name$"="*$text_name$*" | where $drop_name$==description] | mvcombine sourcetype | sort index | table index sourcetype description </PRE> Mon, 03 Jul 2017 20:00:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294466#M160388 chaninphx 2017-07-03T20:00:39Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294467#M160389 <P>What is your requirement here? Could you provide details on different data sources you're using and available fields and relationship between them? </P> Mon, 03 Jul 2017 20:08:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294467#M160389 somesoni2 2017-07-03T20:08:49Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294468#M160390 <P>I'm using two csv files that link three fields together, the index, the sourcetypes from that index, and the description of those sourcetypes. I'm creating an app where you can search and find data for all three fields. However when the user selects that they want to find the description, I want it to find where description="<EM>$text_name$</EM>" instead of "$text_name$*" so it can be easier for the user to find the sourcetype that goes with their description if they only use one word to describe it. </P> Mon, 03 Jul 2017 20:21:13 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294468#M160390 chaninphx 2017-07-03T20:21:13Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294469#M160391 <P>So the $drop_name$ and $test_name are the user input tokens (dropdown or textbox I'm guessing)? Why do you need a subsearch for that if you just want user to filter records based on their inputs.. Something like this should work just fine. (assuming $drop_name$ gives you column name (index/sourcetype/description) and $text_name$ gives the values to be searched)</P> <PRE><CODE>| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | where '$drop_name$'="$text_name$" AND match(description,"$text_name$") | mvcombine sourcetype | sort index | table index sourcetype description </CODE></PRE> Tue, 29 Sep 2020 14:45:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294469#M160391 somesoni2 2020-09-29T14:45:21Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294470#M160392 <P>Thanks for your response somesoni2. So what I want to do is if $drop_name$ turns out to be index or sourcetype then i want the search to be $drop_name$="$text_name$<EM>". If it turns out that the user chose description for $drop_name$, I want it to search $drop_name$="</EM>$text_name$*". Hopefully it makes a little more sense.</P> Tue, 29 Sep 2020 14:45:23 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294470#M160392 chaninphx 2020-09-29T14:45:23Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294471#M160393 <P>Sorry i dont know why it won't put the wildcards in there but there should be one after $text_name$ for input and sourcetype, and then one before and after $text_name$ for description</P> Tue, 29 Sep 2020 14:45:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294471#M160393 chaninphx 2020-09-29T14:45:26Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294472#M160394 <P>Try this. (updated per your last comment)</P> <PRE><CODE>| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | where (("$drop_name$"="index" OR "$drop_name$"="sourcetype") AND like('$drop_name$',"$text_name$%") OR ("$drop_name$"="description" AND match(description,"$text_name$") | mvcombine sourcetype | sort index | table index sourcetype description </CODE></PRE> <P>Essentially, if $drop_name$ is index/sourcetype, it checks full value else, does a match which checks if the values is 'contained' within description field in lookup.</P> Mon, 03 Jul 2017 21:23:56 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294472#M160394 somesoni2 2017-07-03T21:23:56Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294473#M160395 <P>Ok that worked! Thank you!</P> Wed, 05 Jul 2017 16:32:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294473#M160395 chaninphx 2017-07-05T16:32:39Z https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294474#M160396 <P>cool. Don't forget to close the question by Accepting the answer.</P> Wed, 05 Jul 2017 16:44:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fit-a-subsearch-in-the-middle-of-a-search-query/m-p/294474#M160396 somesoni2 2017-07-05T16:44:28Z