topic Re: Subsearch to provide search criteria for outer search in Splunk Search

How to write a Subsearch to provide search criteria for outer search?

dmerrick — Thu, 16 Jun 2022 18:24:29 GMT

Hello, I am trying to do what i believe would be a correlated subquery. I need to search a file for a value, then re-search that same file for everything related to that value.

In a log file of all items and the messages produced as they are processed, I need to search for specific failure messages, grab the item that failed and re-search the file for all messages related to that item.

What I currently have:
source="logs" host="test"

[

search source="logs" host="test" ("failed to subtract" OR "failed to add")

| rex "^[(?<item>[\w.-]+)\].+"

| dedup item

| fields + item

]

| rex "^[(?<item>[\w.-]+)\]\s(?<message>.+)"

| table _time, item, message

The inner [search] gives results on its own, but when placed as a subsearch, the whole provides no results.

Any help would be appreciated!

Re: Subsearch to provide search criteria for outer search

gcusello — Thu, 16 Jun 2022 06:39:36 GMT

Hi @dmerrick,

only one question:

you have the same search condition both in main and subsearch with the only difference of the strings condition in the subsearch, in other words: subsearch is a subset of the main search,

so why don't you use only the subsearch as main?

source="logs" host="test" ("failed to subtract" OR "failed to add") | rex "^[(?<item>[\w.-]+)\].+" | rex "^[(?<item>[\w.-]+)\]\s(?<message>.+)" | table _time, item, message

Then use always the index condition so you'll have faster searches.

Ciao.

Giuseppe

Re: Subsearch to provide search criteria for outer search

ITWhisperer — Thu, 16 Jun 2022 07:11:49 GMT

Try something like this