topic Re: How to use subsearch in Splunk Search

How to use subsearch

Laya123 — Mon, 28 Sep 2020 18:58:16 GMT

Hi,

please help me to use subsearch,

I have a main search query like

index=A host=B cs_method="GET" cst="XXX" | where isnull(ksid) and isnotnull(i_p) | stats c(_raw) by i_p

result of above query is
i_p c(_raw)
CD 3
CW2 1
DYLA 3
ABC12 7
XYZ31 34
jjjwwgga 39
ngrisoew 40
rtucw 43
Poeyt 15

meaning of the above output is, the above i_p s are not using secuirty check for some ids (each i_p is having their respective number of ids which is not using security check for example i_p of ABC12 for this i_p 7 IDs are not using security check)

I want to take the above i_p and check how many are using securitycheck and how many are not using security check

my output will be like

CD 3 123fgs No 2
1456mk No 1
674hjn Yes 1
453bcd Yes 1

CW2 1
DYLA 3
ABC12 7
XYZ31 34
jjjwwgga 39
ngrisoew 40
rtucw 43
Poeyt 15

means i-p of CD have total 5 sessiosons in that 3 sessions not used securitycheck and 2 used security check

I tired the below query but its not showing the output how i am expected

I got output like

CD 2 123fgs No 2
CD 1 1456mk No 1
CD 1 674hjn Yes 1
CD 1 453bcd Yes 1

CW2 1
DYLA 3
ABC12 7
XYZ31 34
jjjwwgga 39
ngrisoew 40
rtucw 43
Poeyt 15

Pl can anyone help me in this

Thanks & Regards

Re: How to use subsearch

cchitten — Tue, 17 Feb 2015 17:51:06 GMT

Can you write a simpler example? With less "sdfsdfas4235q235" and more "a1,a2,b1,b2,etc".

Re: How to use subsearch

markthompson — Wed, 18 Feb 2015 14:38:20 GMT

I'm also interested in the answer to this

Re: How to use subsearch

cchitten — Wed, 18 Feb 2015 15:16:51 GMT

markthompson, can you give me an example of the data you have and what you want to get out and I can try to answer your question?

Re: How to use subsearch

markthompson — Wed, 18 Feb 2015 15:25:16 GMT

Hi cchitten,
We have 2 different events, listed below;
name=com.**************** value=5
name=threshold.max.com*********** value=200

which are transactioned together, but using that we want to use a subsearch in order to get the threshold max out of that transactioned event and set into a field called Max.

Also, Its something completely new to me so would be useful if you know how for v6.0.5

Re: How to use subsearch

cchitten — Thu, 19 Feb 2015 08:16:36 GMT

So you want:

Threshold Value
- 5
Max 200

In that case I dont think you want to use subsearch. I think you want rex such as:

| rex field=_raw "threshold.(?.*)."

This should extract the field you want.

Re: How to use subsearch

markthompson — Thu, 19 Feb 2015 08:44:41 GMT

Yeh we have found this solution now, thanks Cchitten, but I was also wondering how you use subsearches in 6.0.5

Re: How to use subsearch

Laya123 — Thu, 26 Feb 2015 08:33:36 GMT

sorry for delay response, I have done this query which I asked using splunk documentation. Now i am getting results what I expected

Thank you

Re: How to use subsearch

ppablo — Wed, 04 Mar 2015 01:49:12 GMT

Hi @Laya123

Can you please post your final search that actually solved your issue? Otherwise, this post is just going to float on Answers forever without a real solution. Thanks!

Patrick

Re: How to use subsearch

Laya123 — Wed, 04 Mar 2015 08:50:36 GMT

Hi Patrick,

here is the query which I used

index=iis sourcetype=iis host=ABC cs_method="GET" cs_uri_stem="*mriweb.dll*" i_project!="sample" 
| where isnull(ksid) and isnotnull(i_p)  
| eval UsingSecu=if(match(csq, "ksid"), "Yes", "No")

Thanks