topic Re: How to use Subsearch to achieve this ? in Splunk Search

How to use Subsearch to achieve this ?

zacksoft_wf — Thu, 03 Mar 2022 13:56:31 GMT

I have 2 Splunk SPLs
=====================
index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d
| fields comp_name,comp_role,account_name,local_gp,gp_name
| table comp_name,comp_role,account_name,local_gp,gp_name
=====================

The comp_name fields has values such as ,
AAAAA, BBBBB, CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE
Basically I am looking for all the comp_names that the admin is on and copying the list to use in another SPL to get the comp owners.

Second SPL :
===================
index=computer_admin source=emp_card_details sourcetype="something:db" C_NAME IN (AAAAA, BBBBB, CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE)
| eval arl=lower(C_NAME)
| stats values(asset_owner) by arl
===================

Can we use subsearch or any thing similar to get it done in on SPL ?
Any assistance ?

Re: How to use Subsearch to achieve this ?

SanjayReddy — Thu, 03 Mar 2022 13:55:32 GMT

Hi @zacksoft_wf

can you try this

index=computer_admin source=emp_card_details sourcetype="something:db"
| join type=left C_NAME
[| search index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d
| rename comp_name as C_NAME
| table C_NAME,comp_role,account_name,local_gp,gp_name]
| eval arl=lower(C_NAME)
| stats values(asset_owner) by arl

Re: How to use Subsearch to achieve this ?

zacksoft_wf — Thu, 03 Mar 2022 13:53:48 GMT

@SanjayReddy The field name is C_NAME in one SPL and comp_name is another SPL,
In that case will, | join type=left C_NAME truly join the two data sets ?
Just curious, my understanding could be wrong here !

Re: How to use Subsearch to achieve this ?

SanjayReddy — Thu, 03 Mar 2022 13:55:08 GMT

Hi @zacksoft_wf

in sub search we are renaming comp_name as C_NAME to match with data in main query
then both sub search and main searches are joined by common field C_NAME

Re: How to use Subsearch to achieve this ?

zacksoft_wf — Thu, 03 Mar 2022 14:12:26 GMT

@SanjayReddy Thanks Sanjay, this helps.
About the earliest=-1d written in the inner SPL, does it mean , it will force both the inner and outer query to run in the -1d time range , irrespective of the time range chosen in the search-bar ?

Re: How to use Subsearch to achieve this ?

SanjayReddy — Thu, 03 Mar 2022 14:21:13 GMT

Hi @zacksoft_wf

earliest=-1d only applicable to inner search

main search will run on time frame that selected in time range picker

if you want to run both searches on same time frame you can remove earliest=-1d from inner search
then both searche will run as per time rangepicker time

---
If this reply helps you, an upvote/Karma would be appreciated.