topic Re: Running separate searches from a base search? in Splunk Search

Running separate searches from a base search?

szabados — Mon, 12 Dec 2016 12:45:38 GMT

I have a long search, where in the first part, I'm filtering down lots of data, and doing lookup, eval, etc, let's call this my base search
At the end, I want to apply stats to this data set, actually three different functions, and have the results in a table.
I'm able to do this, by running the base search 3 times, applying one of the stats function, and appending it to the other results, like this:

| basesearch | stats 1
| append [|basesearch | stats 2]
| append [|basesearch | stats 3]

Obviously, this is a huge overhead of running the same search 3 times in subsearches. I can't use a datamodel, because the parameters of my subsearch are dynamically populated, and it would be almost impossible to create all the summaries for all the possible values.

Is there any way, to do something like this?

| basesearch
| stats1
| append [| stats2 appended to the data yielded from the base search at the beginning]
| append [| stats3 appended to the data yielded from the base search at the beginning]

Thanks

Re: Running separate searches from a base search?

snoobzilla — Mon, 12 Dec 2016 12:54:17 GMT

Can you add eval/case statements that allow you to do stats2 and stats3 at the same time as you do stats 1?

There was a great presentation on this at .conf2016 by Nick from Sideview. May be worth a look.

https://conf.splunk.com/sessions/2016-sessions.html#search=Let%20Stats%20Sort%20Them%20Out%3A%20Building%20Complex%20Result%20Sets%20That%20Use%20Multiple%20Source%20Types&

Re: Running separate searches from a base search?

somesoni2 — Tue, 13 Dec 2016 00:44:28 GMT

How about this (works best if you've filtered down number of rows after base search signifacantly)

| basesearch | eval exclude=1
| appendpipe [| stats 1 | eval exclude=0 ]
 | appendpipe [| where exclude=1  | stats 2  | eval exclude=0 ]
| appendpipe [| where exclude=1  | stats 3  | eval exclude=0 ]
| where exclude=0

Re: Running separate searches from a base search?

szabados — Fri, 16 Dec 2016 13:41:31 GMT

Thanks, exactly what I needed!