Getting Data In

SubSearch is not getting the info

rockym5
Engager

Hi.

I'm trying to use the subsearch, but I'm not what I am doing wrong.

First the inner search is a list of account like this one.

index=main sourcetype=vpacmanagement
|eval DateStamp3= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval MemberName2 = split(TeamMember, "\\")
| eval Member2 = mvindex(MemberName2,1) | eval Member2=upper(Member2)
| where DateStamp3 > relative_time(now(), "-4d") AND like(Status, "%/%/%") AND Member2 = "ADMMICHAEL_HAYES3"
|dedup WONumber | rename Member2 as Member | fields Member

I get one account, all ok so far. But using the search in an outer search.

index=main sourcetype=vpacmanagement|join Member[search index=main sourcetype=vpacmanagement
|eval DateStamp3= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval MemberName2 = split(TeamMember, "\\")
| eval Member2 = mvindex(MemberName2,1) | eval Member2=upper(Member2)
| where DateStamp3 > relative_time(now(), "-4d") AND like(Status, "%/%/%") AND Member2 = "ADMMICHAEL_HAYES3"
|dedup WONumber | rename Member2 as Member | fields Member]
| eval DateStamp2= strptime(DateStamp, "%Y-%m-%d %H:%M:%S")
| eval month = strftime(DateStamp2, "%m")
| eval year = strftime(DateStamp2, "%Y")
| eval GroupName = split(DomainGroup, "\\"), MemberName = split(TeamMember, "\\")
| eval Name = mvindex(GroupName,1), Member = mvindex(MemberName,1) | eval RequestType = upper(RequestType), Name = upper(Name), Member=upper(Member)
| where not like(Status, "%/%/%") and DateStamp2 > relative_time(now(), "-2d")
|dedup RequestType,DomainGroup, TeamMember
| fields WONumber, DateStamp, ResourceSteward, RequestType, Name, Member, Status
| table WONumber, DateStamp, ResourceSteward, RequestType, Name,Member, Status | sort DateStamp2

 

If you see I made some calculation and I'm using Member field as value to make the join, but still is not getting any account from the outer, and in fact the element exists in the outer search, does anyone knows what am I missing?

Thanks

 

Labels (4)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The subsearch derived the Member field from TeamMember so it would seem the main search, which uses the same index and sourcetype, would expect a field called "TeamMember" to come from the subsearch.  For a join to work properly, both sides must use the same field name(s).  This can be done using rename in the subsearch.

Run the subsearch by itself with | format appended to see what the subsearch turns into.  That resulting string, inserted into the main search, is what produces the final result set.  Adjust the subsearch (or the join command itself) appropriately to get the results you want.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...