Splunk Search

How to fit a subsearch in the middle of a search query

chaninphx
Path Finder

Hi everyone. How do I format this subsearch to work in my search query? I'm still fairly new to splunk

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | search "$drop_name$"="$text_name$*" [search "$drop_name$"="*$text_name$*" | where $drop_name$==description] | mvcombine sourcetype | sort index | table index sourcetype description
Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this. (updated per your last comment)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
 | where (("$drop_name$"="index" OR "$drop_name$"="sourcetype") AND like('$drop_name$',"$text_name$%") OR ("$drop_name$"="description" AND match(description,"$text_name$")
 | mvcombine sourcetype | sort index | table index sourcetype description

Essentially, if $drop_name$ is index/sourcetype, it checks full value else, does a match which checks if the values is 'contained' within description field in lookup.

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this. (updated per your last comment)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
 | where (("$drop_name$"="index" OR "$drop_name$"="sourcetype") AND like('$drop_name$',"$text_name$%") OR ("$drop_name$"="description" AND match(description,"$text_name$")
 | mvcombine sourcetype | sort index | table index sourcetype description

Essentially, if $drop_name$ is index/sourcetype, it checks full value else, does a match which checks if the values is 'contained' within description field in lookup.

0 Karma

chaninphx
Path Finder

Ok that worked! Thank you!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

cool. Don't forget to close the question by Accepting the answer.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

What is your requirement here? Could you provide details on different data sources you're using and available fields and relationship between them?

0 Karma

chaninphx
Path Finder

I'm using two csv files that link three fields together, the index, the sourcetypes from that index, and the description of those sourcetypes. I'm creating an app where you can search and find data for all three fields. However when the user selects that they want to find the description, I want it to find where description="$text_name$" instead of "$text_name$*" so it can be easier for the user to find the sourcetype that goes with their description if they only use one word to describe it.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

So the $drop_name$ and $test_name are the user input tokens (dropdown or textbox I'm guessing)? Why do you need a subsearch for that if you just want user to filter records based on their inputs.. Something like this should work just fine. (assuming $drop_name$ gives you column name (index/sourcetype/description) and $text_name$ gives the values to be searched)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
| where '$drop_name$'="$text_name$" AND match(description,"$text_name$")
| mvcombine sourcetype | sort index | table index sourcetype description
0 Karma

chaninphx
Path Finder

Thanks for your response somesoni2. So what I want to do is if $drop_name$ turns out to be index or sourcetype then i want the search to be $drop_name$="$text_name$". If it turns out that the user chose description for $drop_name$, I want it to search $drop_name$="$text_name$*". Hopefully it makes a little more sense.

0 Karma

chaninphx
Path Finder

Sorry i dont know why it won't put the wildcards in there but there should be one after $text_name$ for input and sourcetype, and then one before and after $text_name$ for description

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...