topic Re: Pass parameters from one search to another in Splunk Search

Pass parameters from one search to another

simonattardGO — Fri, 02 Mar 2012 13:02:13 GMT

Hi all,

We have a system which always logs two lines, Eg:

1) Operation | Status | Time
2) Operation | Type

I want a search which would return all the second lines, where the first line Status is Failed.
Eg. If I have these four logs, I want a search which returns only the 4th line (because the status of the operation is fail)

GET | SUCCESS | 100ms
GET | type1

GET | FAIL | 1000ms
GET | type1

Any ideas on how I can achieve this?

Thanks a lot!

Re: Pass parameters from one search to another

Ayn — Fri, 02 Mar 2012 13:43:01 GMT

I'd extract the "type1" value as a field and then create a transaction.

... | transaction maxevents=2 startswith="GET | FAIL"

Alternatively if you have some kind of unique identifier that connects the two, using a subsearch is more efficient. Say your log looks more like this:

id592 | GET | FAIL | 1000ms
id592 | type1

Then you could extract the identifier (let's call the field "id") and the type1 value ("type") and do:

type=* [search "GET | FAIL" | fields id]