Splunk Cloud Platform

sub search not working

csahoo
Explorer

i want the sub query search result which is a list of tracking id in my main query in clause but none of them are working.
subquery and main working individually but after combining both it's not working, i tried with 3 different option but none of the below are working



1.
index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingID | eval trackingid="\"".mvjoin(trackingid,"\",\"")."\""])

2.
index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingid | table trackingid | stats values(eval("\"".trackingid."\"")) as search delim="," | nomv search])

3.
index="dockerlogs-silver" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) | format]) |table traceID

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats count by traceID
    | eval search="\"".traceID."\""
    | stats values(search) as search
    | eval search = mvjoin(search,",")])
0 Karma
Get Updates on the Splunk Community!

Splunk is Nurturing Tomorrow’s Cybersecurity Leaders Today

Meet Carol Wright. She leads the Splunk Academic Alliance program at Splunk. The Splunk Academic Alliance ...

Part 2: A Guide to Maximizing Splunk IT Service Intelligence

Welcome to the second segment of our guide. In Part 1, we covered the essentials of getting started with ITSI ...

Part 1: A Guide to Maximizing Splunk IT Service Intelligence

As modern IT environments continue to grow in complexity and speed, the ability to efficiently manage and ...