topic Fields Search Issue in Splunk Search

Fields Search Issue

Phynyte — Tue, 11 Mar 2014 17:17:13 GMT

what does the syntax look like so I can pull Multiple fields from a subsearch to an outer search?

index=security "An account was successfully logged on." [search index=randomlogs host=employeetermlist20140311 | rex "(?i)^(?:[^,]*,){2}(?P<ADAcctName>[^,]+)" | rex "(?i) .*?,(?P<TermDate>\\d+/\\d+/\\d+)(?=,)" | rename ADAcctName AS Account_Name | table Account_Name TermDate | fields Account_Name TermDate] | eval NewAccount_Name=mvindex(Account_Name, 1) | stats max(_time) by NewAccount_Name | rename max(_time) AS Last_Login | eval Last_Successful_Login=strftime(Last_Login, "%m/%d/%Y") | table NewAccount_Name TermDate Last_Successful_Login

My search works just find without TermDate and I figured out that the problem is with my fields

I tried listed them multiple different ways but it never pulls TermDate out with my Account_Name?

I know it's something easy just not sure what.

Re: Fields Search Issue

antlefebvre — Tue, 11 Mar 2014 20:17:11 GMT

Check to make sure your extractions are the same case as what you are trying to list. TermDate is not the same as termdate.

Re: Fields Search Issue

Phynyte — Mon, 28 Sep 2020 16:05:41 GMT

I updated the search and it's still not working.

index=security "An account was successfully logged on." [search index=randomlogs host=employeetermlist20140311 | rex "(?i)^(?:[^,],){2}(?P[^,]+)" | rex "(?i) .?,(?P\d+/\d+/\d+)(?=,)" | rename ADAcctName AS Account_Name | table Account_Name termdate | fields Account_Name, termdate] | eval NewAccount_Name=mvindex(Account_Name, 1) | stats max(_time) by NewAccount_Name | rename max(_time) AS Last_Login | eval Last_Successful_Login=strftime(Last_Login, "%m/%d/%Y") | table NewAccount_Name termdate Last_Successful_Login

Re: Fields Search Issue

Phynyte — Tue, 11 Mar 2014 20:50:58 GMT

Yes the inner search works just fine if executed by itself

Re: Fields Search Issue

Phynyte — Tue, 11 Mar 2014 20:55:11 GMT

Yes it does

Re: Fields Search Issue

antlefebvre — Tue, 11 Mar 2014 21:14:27 GMT

I'm guessing your full search is pulling the Account_Name from the security index. Not the randomlogs index. In that case your not actually getting a event matches with the termdate.

Re: Fields Search Issue

somesoni2 — Tue, 11 Mar 2014 21:31:54 GMT

Do the index=security have field named TermDate?

Re: Fields Search Issue

Phynyte — Wed, 12 Mar 2014 11:31:52 GMT

No term date only exists within the randomlogs search. I just want to pull that field out of the inner search and any account name returned I wanted to match the term date in a table beside it