topic Re: Question on subsearch as query filter in Splunk Search

Question on subsearch as query filter

radu_marian — Tue, 29 Sep 2020 12:49:40 GMT

Hi guys,

I'm running a query like:
index=my_index [search index=my_index abcd|table x] |table y

This works out well, but in the job details i see the following message multiple times:
INFO StringSearchExpander - calculated_field="x" not expanded in comparison_expression="x="blahblah"". calc_field_processor!=null, negated=false (negation depth=0)

Can anyone explain what it means and if it impacts the output of my query?

Thanks.

Re: Question on subsearch as query filter

rjthibod — Fri, 10 Feb 2017 10:55:46 GMT

I cannot tell you what that message means, but I suggest you try editing the subsearch a little bit and see if the results changes or that message goes away.

index=my_index [search index=my_index abcd|stats count by x | fields x] |table y

Re: Question on subsearch as query filter

ehudb — Fri, 10 Feb 2017 13:15:42 GMT

The best approach for subsearch filter is to use the return function:
|return 100 x -> return one field named "search" with first 100 values in one row, field name included:
"x=value1 OR x=value2 OR x=value3"
|return 100 $x -> return one field named "search" with first 100 values in one row, no field name included:
"value1 OR value2 OR value3"

index=my_index [search index=my_index abcd|table x|return 100 x] |table y

index=my_index [search index=my_index abcd|table x|return 100 $x] |table