Splunk Dev

Using Results from Subquery

hfalkmeyer
New Member

We are feeding logs from a messaging middleware into our Splunk installation. Input and output logs for this middleware are respectively being stored with sourcetype flags app_input and app_output, with each app_input/app_output pair containing a common, alphanumeric transactionid contained in square brackets. We're trying to build a single line search that will result in a listing of ALL I/O log pairs for which either the app_input or app_output contains a specified string.

Attempting to solve this, we started with sourcetype=app_* some_search | rex "\[(?<transactionid>[A-Za-z0-9]+)\]\". Now, we'd like the search to continue using each extracted transactionid.

We've tried queries w. subqueries along the lines of sourcetype=app_* [ search sourcetype=app_* some_search | rex "\[(?<transactionid>[A-Za-z0-9]+)\]" | rename transactionid as query and others without luck.

Any assistance would be greatly appreciated.

Thank you in advance,

Harold Falkmeyer

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

for this subsearch, try something like this:

sourcetype=app_* [ search sourcetype=app_* some_search | rex "\[(?<transactionid>[A-Za-z0-9]+)\]" | rename transactionid as query|table query|format]

as long as query is in your sourcetype=app_*. your subsearch needs to end with a field name that is in the base search.

View solution in original post

cmerriman
Super Champion

for this subsearch, try something like this:

sourcetype=app_* [ search sourcetype=app_* some_search | rex "\[(?<transactionid>[A-Za-z0-9]+)\]" | rename transactionid as query|table query|format]

as long as query is in your sourcetype=app_*. your subsearch needs to end with a field name that is in the base search.

hfalkmeyer
New Member

Worked like a charm. The missing component from my attempts was the table query. Thank you VERY much!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...