Dashboards & Visualizations

Subsearch: How to create a search which returns multiple values?

madhukar3us
Engager

Hi,

I have a search query which returns multiple values. For example, the search query returns abc, def, ghi.

I need to take this as input and  i need to perform a search of these values. The logs contains the abc-123-678, def-678+943 , ghi-678-123 and i need to search the events that contains these strings.

Any suggestions?

 

 

Labels (1)
0 Karma
1 Solution

gcusello
Legend

Hi @madhukar3us ,

if you need to use the result of a subquery to search  as text in the main search, you have to follow this approach

supposing that the field in the subsearch containing the values to search is "my_field"

your_main_search [ search your_secondary_search  rename my_field AS query | fields query ]

Ciao.

Giuseppe

View solution in original post

marysan
Communicator

Hi
I suppose that you need join command for example :
index=index1 abc=123-678  def=678+943 , ghi=678-123
| fields abc,def,ghi
| join type=inner abc,def,ghi
 [| search index=index2]

0 Karma

gcusello
Legend

Hi @madhukar3us ,

if you need to use the result of a subquery to search  as text in the main search, you have to follow this approach

supposing that the field in the subsearch containing the values to search is "my_field"

your_main_search [ search your_secondary_search  rename my_field AS query | fields query ]

Ciao.

Giuseppe

danielcj
Communicator

Hello @madhukar3us ,

Could you please provide more information? Are these values on the same field? Could you also share some log samples?

 

Thanks.

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...