topic Re: Subquery - modify format with multiple conditions in Splunk Search

Subquery - How can I modify format with multiple conditions?

emilep — Mon, 01 May 2023 13:45:10 GMT

Hello,

The default format of my subsearch result looks like:

(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" ))

I would like to modify subsearch format result like:

(( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))

Do you think it is possible?

Regards,
Emile

Re: Subquery - modify format with multiple conditions

richgalloway — Sat, 29 Apr 2023 17:00:44 GMT

It is not possible. The format command (either implicit or explicit) is not that flexible.

Re: Subquery - modify format with multiple conditions

PickleRick — Sat, 29 Apr 2023 17:09:55 GMT

The format command is called either explicitly or implicitly at the end of the subsearch unless you return a field called "search". If your subsearch returns a "search" field, that value is directly substituted into the outer search.

So as long as you can manually craft such search string in your subsearch you can do it. The format command just makes it easy to handle typical case.

Re: Subquery - modify format with multiple conditions

yuanliu — Sun, 30 Apr 2023 23:04:32 GMT

In addition to semantic equivalence, there is often efficiency to be gained by converting an OR group to consecutive ANDs because true parallel processing is still a pipe dream for most compilers. I suspect that's why the SPL compiler tries to optimize.

Why do you want to change format output, anyway? If you want your search to be more semantic, you can write in any way you want.

Re: Subquery - modify format with multiple conditions

emilep — Tue, 02 May 2023 06:21:24 GMT

As it exist some priority between AND and OR, it is right that the supplementary parentheses have no sense.
To solve my problem i used the command replace like this:

...|format|eval search = replace(search, "AND mid=", "OR mid=")

It is not perfect but it is working for now ...
Thanks for your help.

Re: Subquery - modify format with multiple conditions

yuanliu — Tue, 02 May 2023 07:28:41 GMT

Do you realize that by doing so, you are changing semantics of the original subsearch?

Output of replace

Equivalent of original subsearch

(( Host_Name="srv1" AND icid="va1_icid1" OR mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" OR mid="val_mid2" ))

(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" ))

and

(( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))

That you need such a replacement means that the subsearch is incorrect for your purpose. Usually revising the subsearch is a better option.