topic Re: Subsearch Help in Splunk Search

Subsearch Help

alan20854 — Fri, 24 Jun 2016 14:05:30 GMT

Hi,

I'm trying to create a search query that displays all the events with Incorrect result: but excludes the cases where the same ID contains an event with Sending result.

The query below shows the list of all the problem cases:

host=* source=*  "Incorrect result:" | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"  | stats count by ID

How would I write a search query to do this?

Re: Subsearch Help

sundareshr — Fri, 24 Jun 2016 14:16:39 GMT

Try this

host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | chart count over ID by status | where Sending=0 | fields - Sending

Re: Subsearch Help

alan20854 — Fri, 24 Jun 2016 14:20:19 GMT

Hi sundareshr, I am not getting any events from that query

Re: Subsearch Help

woodcock — Fri, 24 Jun 2016 14:23:57 GMT

Like this:

ihost=* source=* ("Incorrect result:" OR "Sending result") | rex field=_raw "\x5BE=(?P[0123456789]+)\x5D"|
| eventstats count(eval(searchmatch("Incorrect result:"))) AS badCount count(eval(searchmatch("Sending result"))) AS goodCount BY ID
| where goodCount=0

Re: Subsearch Help

sundareshr — Fri, 24 Jun 2016 14:24:55 GMT

WHat do you get when you run this command?

host= source= "Incorrect result:" | rex field=_raw "\x5BE=(?P<ID>[0123456789]+)\x5D" | rex field=_raw "(?<status>Sending|Incorrect)\s*result" | table _time ID status

I also noticed, the first rex command was missing the field name. See the edited one