topic Re: Subsearch field groupings in Splunk Search

Subsearch field groupings

brywilk_umich — Tue, 29 Sep 2020 11:25:42 GMT

Hello,

I have a search (see below) that Im having a little trouble with. With it it returns the fields correctly, but its just a lot of ORs (like src_ip=1 OR src_ip=2 OR src_port=1 OR src_port=2). What Im trying to figure out is, how would I write the query so that the inner search would return the fields in groups to the outer search like (src_ip=1 AND src_port=1 AND dst_ip=1 AND dst_port=1). Any thoughts? THANKS!

index=firewall sourcetype=juniper_vgw action=allow ip_proto!=17 rule_id!=263
[search index=firewall sourcetype=vmware:dfw rule_id=6710 NOT UDP
| fields src_ip src_port dst_ip dst_port]

Re: Subsearch field groupings

somesoni2 — Fri, 14 Oct 2016 14:48:21 GMT

How about this

index=firewall sourcetype=juniper_vgw action=allow ip_proto!=17 rule_id!=263
[search index=firewall sourcetype=vmware:dfw rule_id=6710 NOT UDP
| fields src_ip src_port dst_ip dst_port | format]

index=firewall sourcetype=juniper_vgw action=allow ip_proto!=17 rule_id!=263
[search index=firewall sourcetype=vmware:dfw rule_id=6710 NOT UDP
| stats count by src_ip src_port dst_ip dst_port | fields - count | format]

Re: Subsearch field groupings

javiergn — Fri, 14 Oct 2016 14:49:44 GMT

Hi,

You can easily test what your subsearch is doing by using the format command.

For example, in my case I'm simply looking for events that have all the four fields below and then returning the first two I find. Finally pipe it to format to see what would happen if you were using this in a subsearch:

index=* src_ip=* src_port=* dest_ip=* dest_port=* 
| head 2
| fields src_ip src_port dest_ip dest_port
| format

Output:

( ( dest_ip="10.150.2.155" AND dest_port="53" AND src_ip="10.152.205.27" AND src_port="12345" ) OR ( dest_ip="10.150.2.155" AND dest_port="53" AND src_ip="10.152.205.27" AND src_port="12345" ) )

Which basically means: "Fields from event 1 joined with AND" OR "Fields from event 2 joined with AND"

Let me know if that helps.

Thanks,
J

EDIT: didn't notice the answer from somesoni above but that should give you what you are looking for

Re: Subsearch field groupings

mgrosholz — Fri, 14 Oct 2016 14:51:19 GMT

The question is a little convoluted. Could you clarify if you are looking to eval between the two searches or search the "| fields..." for the entire search string? If it's the latter you can just pull it out of the subsearch.

Re: Subsearch field groupings

brywilk_umich — Fri, 14 Oct 2016 16:02:21 GMT

that worked, thanks a bunch!