topic Re: Use Subsearch to insert commands in Splunk Search

Use Subsearch to insert commands

duesser — Thu, 26 Oct 2023 09:17:29 GMT

Hello,

I would like to use a subsearch to literally paste a command into the SPL e.g.:

and for it to be equivalent to

| makeresults | eval t1 = "hello"

Is this possible?

Re: Use Subsearch to insert commands

gcusello — Thu, 26 Oct 2023 08:22:02 GMT

HI @duesser,

when you use a subsearch, you run a search on the main search using the output (exactly the fields you have in return or in fields).

What's your requirement?

Ciao.

Giuseppe

Re: Use Subsearch to insert commands

duesser — Thu, 26 Oct 2023 08:30:46 GMT

I know that I can do

index=abc [ | makeresults | addinfo | eval filter_t="earliest=".(info_min_time-60)." latest=".info_max_time | return filter_t ]

which literally becomes

index=abc earliest=1698301592.0 latest=1698301792.0

and I would like to use this behavior to dynamically define a command

Re: Use Subsearch to insert commands

gcusello — Thu, 26 Oct 2023 09:12:02 GMT

Hi @duesser,

pleae try this:

index=abc [ | makeresults | addinfo | eval earliest=relative_time(info_min_time,"-60s"), latest=info_max_time | fields earliest latest ]

Ciao.

Giuseppe

Re: Use Subsearch to insert commands

duesser — Thu, 26 Oct 2023 09:16:34 GMT

I am sorry for the confusion, I updated the original question.

The idea is to dynamically create strings of eval commands in a sub search (depending on a lookup e.g.) and then applying these to the base search by literally putting the into the search command. I hope I could clarify this now.

Re: Use Subsearch to insert commands

PickleRick — Thu, 26 Oct 2023 09:33:42 GMT

Do a quick test:

[ | makeresults | eval search="| makeresults" ]

If you look into the job log you'll see that while the internal search will get expanded to

Expanded index search = ([ | makeresults | eval search="| makeresults" ])

After the subsearch is evaluated and the result is returned to the outer search it will be treated as a string, with the pipe control character escaped

Expanded index search = (\| makeresults)

Which means that you will be searching for literal pipe character and "makeresults" word.

Re: Use Subsearch to insert commands

duesser — Thu, 26 Oct 2023 09:35:48 GMT

Yes I have seen this exactly. But is it possible to work around this in any way?

Re: Use Subsearch to insert commands

PickleRick — Thu, 26 Oct 2023 09:41:24 GMT

I should expect not.

Re: Use Subsearch to insert commands

gcusello — Thu, 26 Oct 2023 10:41:48 GMT

Hi @duesser ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉