Is it possible to use a base search in a subsearch?

[jip31]

hello

is it possible to use a base search in a subsearch?

I would like to call the base search

  <search id="signal1">
    <query>`index=test
            </query>
    <earliest>$date.earliest$</earliest>
    <latest>$date.latest$</latest>
  </search>

 in my subsearch

something like this?

<search base="signal1">
          <query>index=test
| stats count as "Nombre total d'erreurs" 
| appendcols 
    [ search base="signal1" >
     <query>index=test
| stats count as "Nombre total d'erreurs"</query>
      

thanks

[PickleRick]

Yes, you can use append in your post-process search.

For example:

"dataSources": {
  "ds_PAGOQqsD": {
    "type": "ds.search",
    "options": {
      "query": "index=winevents \n| head 10"
      },
    "name": "Base_search"
    },
  "ds_RCWyOpI4": {
    "type": "ds.chain",
    "options": {
      "extend": "ds_PAGOQqsD",
      "query": "append \n [ search index=linevents \n | head 10 ]\n| stats count by index\n| table index count"
      },
    "name": "Appended_search"
    }
  }
}

This one is from the Dashboard studio so it's json, not XML but yhe idea is of course the same.

As you can see, the base search should return 10 rows, the post-process search appends another 10 rows from another index, then at the end we do the stats and get

So you can use subsearches. But of course remember about all the typical limitations of subsearches. Also remember that if you return many rows from the base search, it will also get truncated to 50k results like a subsearch!

[jip31]

thanks but an example with xml instaed json will be appreciated

[PickleRick]

It's not about the json/xml syntax itself. It's about how you do the post-process search. 🙂

The syntax is your typical post-process search syntax as shown with examples here http://docs.splunk.com/Documentation/Splunk/9.0.1/Viz/Savedsearches#Post-process_searches_2

It's that your post-process search would need to include the whole append [...] | whatever part. That's all.

[PickleRick]

I'm not fully sure what you want to achieve but subsearches can be used with Splunk. There are some usecases where they can be useful, there are some cases where they should be avoided (and other search constructions should be used instead). They have their limitations but they have their legitimate uses.

So what do you want to achieve with this subsearch because "I want to use a subsearch" is not a business need. What problem are you trying to solve?

[jip31]

I use a subsearch because i need to concatene différent kpi from à samedi index and to transpose résultats in a same table panel

But the search is a little slow so i was wondering if it was possible to call the index just one time in the search using a base search instead many times