topic Re: Subsearch / query with inputlookup in Splunk Search

Subsearch / query with inputlookup

Cranie — Fri, 01 Sep 2023 11:50:42 GMT

Apologies, I am quite new to Splunk so not sure if this is possible, I have the following simple query:

| inputlookup appJobLogs | where match(MessageText, "(?i)general error") | rex mode=sed field=MessageText "s/, /\n/g" | sort RunStartTimeStamp asc, LogTimeStamp asc, LogID ASC

This works and gets the data I need for the error I am after, but, I want all associated values for the error by RunID.

So the headers are:
Host, InvocationID, Name, LogID, LogTS, LogName, MessageID, MessageText, RunID, RunTS, RunName

I would like to do something like:

I have tried various forms and closest I got was a join which gave me the not found fields (should be fixable) but limited to 10,000 results so that seems like the wrong solution.

Re: Subsearch / query with inputlookup

richgalloway — Fri, 01 Sep 2023 12:14:56 GMT

If you want events grouped by one or more fields then you want the stats command.

| inputlookup appJobLogs | where match(MessageText, "(?i)general error") | rex mode=sed field=MessageText "s/, /\n/g" | stats values(*) as * by RunID

Re: Subsearch / query with inputlookup

ITWhisperer — Fri, 01 Sep 2023 12:17:29 GMT

Try something like this

| inputlookup appJobLogs where [ | search appJobLogs | where match(MessageText, "(?i)general error") | fields RunID ]

Re: Subsearch / query with inputlookup

Cranie — Fri, 01 Sep 2023 14:01:55 GMT

I got an error

"The 'NOT ()' filter could not be optimized for search results."

I'll look into. Thanks for the suggestion

Re: Subsearch / query with inputlookup

Cranie — Fri, 01 Sep 2023 14:05:20 GMT

This is pretty much what I want, but there are other RunID lines that do not have the "general error" message that I want to capture also. So your example groups all RunID's and the MessageText with "general error".

What I need is, all RunID entries for the RunID with MessageText "general error".

I.e:

RunId	MessageText
1	Start
1	There has been a general error.
1	Finish
2	Start

So I find the RunID 1 having the error and I want to output the start, finish and the error too. If that is possible, and in this example, not RunID 2.

Re: Subsearch / query with inputlookup

Cranie — Fri, 01 Sep 2023 14:31:37 GMT

After a little tweaking this gives the desired results: