topic Re: Adding data to the table from subsearch in Splunk Search

Adding data to the table from subsearch

abroun — Tue, 02 Apr 2024 12:03:56 GMT

Hey, I have a problem preparing a Splunjk query. Could you assist me?

I have a simple query that returns a table with a few fields:

some-search | fields id, time | table id, time

I also have a macro with two arguments (id and time) that returns a table with status and type fields.

I want to modify the first query somehow to run a subquery for each row by calling my macro and appending the fields to the final table.

Finally, I want to have a table with four fields: id, time, status, and type (where status and type were obtained by calling a subquery with id and time).

Is it possible?

Re: Adding data to the table from subsearch

gcusello — Tue, 02 Apr 2024 12:16:47 GMT

Hi @abroun,

to help you I need also the second search.

In few words, you have to correlate results from both the searches using stats BY common key.

Ciao.

Giuseppe

Re: Adding data to the table from subsearch

abroun — Tue, 02 Apr 2024 12:27:43 GMT

The second search (macro) is like:

Re: Adding data to the table from subsearch

gcusello — Tue, 02 Apr 2024 14:40:39 GMT

Hi @abroun,

probably this is the only case where join could be the best solution:

Ciao.

Giuseppe