topic Re: Equivalent timechart correlation query without subsearch in Splunk Search

Equivalent timechart correlation query without subsearch

dzhangw7 — Tue, 11 Mar 2025 04:29:31 GMT

Can someone help create an equivalent query to the following, without using subsearch? There are probably too many results and the query does not complete.

index=my_index
[search index=my_index ("Extracted entities" AND "'date': None") OR extracted_entities.date=null | stats count by entity_id | fields entity_id | format]
"Check something" | timechart count by classification

Basically I want to extract the list of entity_ids from this search: [search index=my_index ("Extracted entities" AND "'date': None") OR extracted_entities.date=null] where dates are null and then use those IDs to correlate in a second search "Check something" which has a field "classification", and then I want to do a timechart on the result to see a line graph of events where a date was missing from an event, plus with a given classification.

Re: Equivalent timechart correlation query without subsearch

gcusello — Tue, 11 Mar 2025 07:49:48 GMT

Hi @dzhangw7 ,

why are you using a subsearch?

you can put all the conditions in the main search:

index=my_index "Check something" (("Extracted entities" AND "'date': None") OR extracted_entities.date=null) | timechart count by classification

eventually adding a condition on identity_id

index=my_index "Check something" (("Extracted entities" AND "'date': None") OR extracted_entities.date=null) identity_id=* | timechart count by classification

Ciao.

Giuseppe

Re: Equivalent timechart correlation query without subsearch

PickleRick — Tue, 11 Mar 2025 09:16:16 GMT

As @gcusello already pointed out - if your subsearch reaches to the same index as the outer search, it's pointless to do it this way. Limiting the base search is enough.

But if you want to correlate events from two different indexes, you'd need to search from both indexes at the same time (join conditions with OR) and then do some stats by common field.

Anyway,

| stats count by entity_id | fields entity_id

doesn't make much sense. It's enough to do

| stats values(entity_id) as entity_id