Splunk Search

Add transactions with a sub-search

Path Finder



Could you help me on the following search please?

I have a main search which groups me together all the events with a unique ID (these events are critical, warning and normal alerts that I index on Splunk).
I want to add a sub-search to my main search which could allow me to add other events in the form of a transaction. My problem here is that my unique ID in my main search is not the same as in my sub search.
this is what I want to do :

index=index1 (severity=2 OR severity=0 OR severity=1 OR (severity="-1" AND Function=Traps))
| eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+managed_entity+"_"+varname
| addinfo

| append [search index=index_sqlprod-itrs_toc (managed_entity="vpw-neorc-103 - rec" OR managed_entity="vpw-neorc-903 - rec") rowname="ASC RecordingControl"
| eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+varname
| addinfo
| sort _time asc
| eval peer_failed=if(severity=2,1,-1)
| streamstats sum(peer_failed) as failed_peers by ID
| eval failed_peers=if((failed_peers=1) AND (severity="0" OR severity="-1"),3,failed_peers)
| where NOT (failed_peers=1 OR failed_peers=0)
| sort _time desc
| transaction ID startswith=(failed_peers=2) endswith=(failed_peers=3) maxevents=2]

| transaction ID startswith=(severity=2) maxevents=2

 my goal is to bring these transactions together without having the same ID, is that possible?

Labels (4)
0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...