https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113126#M29715 <P>Not the way you are doing it. You can return data from a subsearch, either as a single value, a field-value pair, or set of field-value pairs. That't not the problem.</P> <P>What you <EM>can't</EM> do is to pass data from the main search to the subsearch. <CODE>where field_SUB=field_MAIN</CODE> is not legal. Splunk executes the subsearch <STRONG>first</STRONG>, so there is no data from the main search to pass.</P> <P>If you want to combine data from two searches in that way, you will need to use another technique. For the example you have given, it appears that you are trying to lookup a value for fieldA from index=other_index. For that, I would use a lookup instead of a second index.</P> <P>More information about what you are trying to do would probably be helpful.</P> Sun, 07 Sep 2014 02:19:37 GMT lguinn2 2014-09-07T02:19:37Z https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113125#M29714 <P>Hi<BR /> You can send a parameter from the main search to return search? <BR /> I need to put a condition to return value, something like this:</P> <PRE><CODE>index=main field_MAIN=* | eval test=if(isNull(fieldA),[search index=other_index field_SUB=* | where field_SUB=field_MAIN | head 1 | return $fieldA],fieldA) </CODE></PRE> <P>Note the <CODE>where field_SUB=field_MAIN</CODE></P> <P>is it possible? <BR /> Or some other way to get it?<BR /> Thanks!!</P> Fri, 05 Sep 2014 14:39:32 GMT https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113125#M29714 jrodriguezap 2014-09-05T14:39:32Z https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113126#M29715 <P>Not the way you are doing it. You can return data from a subsearch, either as a single value, a field-value pair, or set of field-value pairs. That't not the problem.</P> <P>What you <EM>can't</EM> do is to pass data from the main search to the subsearch. <CODE>where field_SUB=field_MAIN</CODE> is not legal. Splunk executes the subsearch <STRONG>first</STRONG>, so there is no data from the main search to pass.</P> <P>If you want to combine data from two searches in that way, you will need to use another technique. For the example you have given, it appears that you are trying to lookup a value for fieldA from index=other_index. For that, I would use a lookup instead of a second index.</P> <P>More information about what you are trying to do would probably be helpful.</P> Sun, 07 Sep 2014 02:19:37 GMT https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113126#M29715 lguinn2 2014-09-07T02:19:37Z https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113127#M29716 <P>Hello Iguiin <BR /> Thanks, look, I have logs like these:</P> <PRE><CODE> session_id src_email dst_email f2-5407ee2265d2 alexcolquehuanca@hotmail.com jperez@unicon.com f2-54asds326sf3 asistecnica@assesores.com jose.tejadaz@unicon.com f2-54ds345asf32 secretary@unicon.com f2-5407easass22 josevasquez@gmail.com jose.tejadaz@unicon.com f2-54ds345asf32 alemontorya@verifica.com </CODE></PRE> <P>You see, there are some who lack the src_email field, then I try to fill it doing that search return, associating with the session_id field. <BR /> I tried to "transaction" masspan = 1d, but in reality, the waiting time to run is very high</P> <PRE><CODE>host=172.16.1.21 | eval dst_email=if(isNull(src_email),[search host=172.16.1.21 src_email=* earliest=-1d latest=now | where session_id=session_idMAIN | head 1| return $src_email],src_email) | table session_id,src_email,dst_email </CODE></PRE> Mon, 28 Sep 2020 17:30:42 GMT https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113127#M29716 jrodriguezap 2020-09-28T17:30:42Z https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113128#M29717 <P>Hello<BR /> You think that is possible? or is there any other way?</P> Mon, 08 Sep 2014 16:45:01 GMT https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113128#M29717 jrodriguezap 2014-09-08T16:45:01Z https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113129#M29718 <P>This will work for the example you have given - and be much faster</P> <PRE><CODE>host=172.16.1.21 | stats values(src_email) as src_email values(dst_email) as dst_email by session_id </CODE></PRE> Mon, 08 Sep 2014 23:26:46 GMT https://community.splunk.com/t5/Splunk-Search/send-parameter-to-eval-with-return-search/m-p/113129#M29718 lguinn2 2014-09-08T23:26:46Z