topic Subsearch does not work in Splunk Search

Subsearch does not work

simuvid — Thu, 09 Jun 2011 13:46:48 GMT

What is wrong with following search:

sourcetype="security" ip=[search sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | stats count, values(clientip) by status]

What I get is following message:

Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the right hand side.

Any hints?

Cheers

simuvid

Re: Subsearch does not work

ziegfried — Thu, 09 Jun 2011 14:11:14 GMT

A subsearch is used this way:

sourcetype="security" [ search sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | fields clientip | dedup clientip | rename clientip as ip ]

The subsearch should return a result like this

|    ip     |
| --------- |
| 10.1.1.1  |
| 10.1.1.2  |
| 10.1.1.3  |

Which will expanded to the following condition:

( ( ip="10.1.1.1") OR (ip="10.1.1.2") OR (ip="10.1.1.3") )

You can inspect the conditions generated by the subsearch by executing:

sourcetype=access_combined status=401 clientip=* | transaction fields clientip | where eventcount>2 | fields clientip | dedup clientip | rename clientip as ip | format

Re: Subsearch does not work

simuvid — Fri, 10 Jun 2011 12:55:37 GMT

Thanks!!!

That one works as expected!

Cheers,

simuvid