topic Re: Use a sub-search result as table fields in Splunk Search

How to use a sub-search result as table fields?

nextpart — Thu, 28 Jul 2022 15:07:04 GMT

I am trying to use a search to find fields that I want to use in another search as a table field.

The first search should return all fields that are used in a datamodel. This looks like this:

| datamodel "Authentication" | spath output=foo path=objects{} | spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName | spath input=foo output=field path=fields{}.displayName | eval fields = mvappend(calc_field , field) | mvexpand fields | table fields

Then I want to use the list of fields in the table command. I do this for the reason to be able to check the coverage of the CIM fields in the search. Unfortunately, so far without success, so I am grateful for all ideas and any kind of input.

My first guess was something like:

index="main" sourcetype="XmlWinEventLog" tag="authentication" | table [ | datamodel "Authentication" | spath output=foo path=objects{} | spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName | spath input=foo output=field path=fields{}.displayName | eval fields = mvappend(calc_field , field) | mvexpand fields | format "" "" "," "" "" "" | rex mode=sed field=search "s/fields=//g" | rename search as table ]

Re: Use a sub-search result as table fields

ITWhisperer — Thu, 28 Jul 2022 10:50:39 GMT

Try something like this:

index="main" sourcetype="XmlWinEventLog" tag="authentication" | table [ | datamodel "Authentication" | spath output=foo path=objects{} | spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName | spath input=foo output=field path=fields{}.displayName | eval query = mvappend(calc_field , field) | mvexpand query | format "" "" "" "" "" "" ]

Re: Use a sub-search result as table fields

nextpart — Thu, 28 Jul 2022 11:07:32 GMT

Hi @ITWhisperer , thanks for your reply. I already tried that one but get the following error:

Error in 'table' command: Invalid argument: 'calc_field=action'

Re: Use a sub-search result as table fields

ITWhisperer — Thu, 28 Jul 2022 11:16:35 GMT

Sorry, I missed a line

index="main" sourcetype="XmlWinEventLog" tag="authentication" | table [ | datamodel "Authentication" | spath output=foo path=objects{} | spath input=foo output=calc_field path=calculations{}.outputFields{}.displayName | spath input=foo output=field path=fields{}.displayName | eval query = mvappend(calc_field , field) | fields query | mvexpand query | format "" "" "" "" "" "" ]