topic Passing results from subsearch to a field in parent search in Splunk Search

Passing results from subsearch to a field in parent search

Splunkquish — Thu, 05 May 2016 15:31:30 GMT

Hello!

I'm interested in passing a result or results (a list of users from proxy logs) from a subsearch into a field in my parent search (against AV logs). I tried using eval, but was unsuccessful. Is it possible to pass results from a subsearch into a variable? Any help would be appreciated!

Something like this doesn't work:

index=MyData sourcetype=AV_logs user=[index=MyData sourcetype=Proxy_logs src_ip="X.X.X.X" dst_port="80" domain="*pleasehelpme.splunk"| table user] | table user, event, etc

Re: Passing results from subsearch to a field in parent search

sundareshr — Thu, 05 May 2016 15:55:14 GMT

Remove user= in your main search. Like this

index=MyData sourcetype=AV_logs [index=MyData sourcetype=Proxy_logs src_ip="X.X.X.X" dst_port="80" domain="*pleasehelpme.splunk"| table user] | table user, event, etc

Re: Passing results from subsearch to a field in parent search

Splunkquish — Thu, 05 May 2016 18:36:04 GMT

I'm still not having any luck with my query. When I run my subsearch separately, it successfully produces a table of values, but when it's with a parents search, I get "no results found." Is there a way to pass values from a subsearch directly to a field in my parent search?

Thanks for your help!

Re: Passing results from subsearch to a field in parent search

sundareshr — Tue, 29 Sep 2020 09:36:32 GMT

Do you get valid results when you run the main search and the sub search separately? Are there any matching?

The option would be to try grouping.. like this
(index=MyData sourcetype=AV_logs) OR (index=MyData sourcetype=Proxy_logs src_ip="X.X.X.X" dst_port="80" domain="*pleasehelpme.splunk") | stats values(event) as event values(sourcetype) as st by user | where mvcount(st)=2

Re: Passing results from subsearch to a field in parent search

Splunkquish — Thu, 05 May 2016 19:05:17 GMT

There are matching results for the fields I'm interested in in both the main and sub searches.

Re: Passing results from subsearch to a field in parent search

sundareshr — Thu, 05 May 2016 19:22:34 GMT

Check fieldnames in both, they are case sensitive. Did you try the second option? Also, there are limitation to subsearch, how many events do both searches return?

Re: Passing results from subsearch to a field in parent search

Splunkquish — Thu, 05 May 2016 19:56:16 GMT

I'm actually testing this with two sets of web traffic logs since most of the data is similar. Both return 3000+ results (source IP) using dedup for a 15 minute period.

I haven't tried the other option you suggested. I'm not sure what the "values(event)," "st by user," or "mvcount(st)" means as I've never used them. Is there something I can reference for more information?

Re: Passing results from subsearch to a field in parent search

sinash — Tue, 21 Feb 2017 09:00:05 GMT

subsearches should start with [ search.

Re: Passing results from subsearch to a field in parent search

rjthibod — Tue, 21 Feb 2017 09:17:40 GMT

Line @sinash said. This would be the updated query

index=MyData sourcetype=AV_logs [search index=MyData sourcetype=Proxy_logs src_ip="X.X.X.X" dst_port="80" domain="*pleasehelpme.splunk"| table user] | table user, event, etc