Archive

Question on subsearch as query filter

radu_marian
New Member

Hi guys,

I'm running a query like:
index=my_index [search index=my_index abcd|table x] |table y

This works out well, but in the job details i see the following message multiple times:
INFO StringSearchExpander - calculated_field="x" not expanded in comparison_expression="x="blahblah"". calc_field_processor!=null, negated=false (negation depth=0)

Can anyone explain what it means and if it impacts the output of my query?

Thanks.

Tags (1)
0 Karma

ehudb
Contributor

The best approach for subsearch filter is to use the return function:
|return 100 x -> return one field named "search" with first 100 values in one row, field name included:
"x=value1 OR x=value2 OR x=value3"
|return 100 $x -> return one field named "search" with first 100 values in one row, no field name included:
"value1 OR value2 OR value3"

index=my_index [search index=my_index abcd|table x|return 100 x] |table y

index=my_index [search index=my_index abcd|table x|return 100 $x] |table 
0 Karma

rjthibod
Champion

I cannot tell you what that message means, but I suggest you try editing the subsearch a little bit and see if the results changes or that message goes away.

index=my_index [search index=my_index abcd|stats count by x | fields x] |table y
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!