topic How do you perform a sub search over indexes? in Splunk Search

How do you perform a sub search over indexes?

Marinus — Tue, 06 Sep 2011 08:52:07 GMT

I've recently split up my data into indexes and some of my searches that make use of sub searches are now breaking.

For example I previously did a

tag::host=esb* [search TestService | fields + transaction_id] | transaction transaction_id

To cater for the index change I did

index=test tag::host=esb* [search TestService | fields + transaction_id] | transaction transaction_id

No luck, I even stuck an index into the subsearch with no results.

What is the correct syntax?

Marinus

Re: How do you perform a sub search over indexes?

Ayn — Tue, 06 Sep 2011 09:07:44 GMT

I assume you want the subsearch to go against the test index as well. The subsearch runs on its own and returns its results to the outer search, so any search parameters you add to the outer search do not affect the subsearch. Add index=test in the subsearch instead and have it return what index it's operating on to the outer search so that it uses the same index. Llike this:

tag::host=esb* [search index=test TestService | fields transaction_id,index] | transaction transaction_id

Re: How do you perform a sub search over indexes?

Marinus — Fri, 09 Sep 2011 13:36:37 GMT

I found a workaround. I'm using the internal index as an example.

index=_internal [search index=_internal | head 1000 | fields + user] | transaction user