topic Re: Use subsearch result as fulltext search in outer search in Splunk Search

Use subsearch result as fulltext search in outer search

woezelmann — Fri, 10 Jul 2015 07:22:18 GMT

Is it possible to use the result value of a subsearch as a fulltext (or wildcard) search in the outer search. I have a subsearch like this:

servertype=abc "some search terms" | fields correlation_id

and now I want to use the resulting correlation ids to find other entries, but these entries do not have a dedicated correlation_id field, it is just somewhere inside the text, so this is not working

servertype=xyz "some other seach terms" [search servertype=abc "some search key" | fields correlation_id]

because splunk is searching for a correlation_id field, which does not exist.

This is a very simplified example, but I hope you get my problem.

Re: Use subsearch result as fulltext search in outer search

woodcock — Fri, 10 Jul 2015 13:50:46 GMT

This should work (but performance will be slow)

[servertype=abc "some search terms" | eval _raw = "*" . correlation_id . "*" | fields _raw]

But for some reason it does not and I don't know why!

Re: Use subsearch result as fulltext search in outer search

woodcock — Fri, 10 Jul 2015 15:47:43 GMT

Further testing is also strange:

|noop | stats count | eval _raw="*972*" | fields _raw | format
|noop | stats count | eval raw="*972*" | fields raw | format | replace "*raw*" with "*_raw*"

These should both create a field called search with value ( ( _raw="*972*" ) ) but they don't.

Re: Use subsearch result as fulltext search in outer search

woodcock — Fri, 10 Jul 2015 20:06:50 GMT

OK, this is funky but it works:

 ... | eval raw=_raw | search [search servertype=abc "some search terms" | eval raw= "*" . correlation_id . "*" | fields raw]

Re: Use subsearch result as fulltext search in outer search

woezelmann — Mon, 13 Jul 2015 15:38:27 GMT

Great, now it works. Thank you very much!

Re: Use subsearch result as fulltext search in outer search

marcoscala — Tue, 29 Sep 2020 09:07:29 GMT

Use this:

servertype=xyz "some other seach terms" [search servertype=abc "some search key" | fields correlation_id | rename correlation_id as search]

as stated here:
http://docs.splunk.com/Documentation/Splunk/latest/Search/Changetheformatofsubsearchresults

Re: Use subsearch result as fulltext search in outer search

606866581 — Fri, 27 Jul 2018 13:11:09 GMT

I had to use ..... | rename correlation_id as query]