Splunk Search

Adding data to the table from subsearch

abroun
Engager

Hey, I have a problem preparing a Splunjk query. Could you assist me?

I have a simple query that returns a table with a few fields:

 

 

some-search | fields id, time | table id, time

 

 


I also have a macro with two arguments (id and time) that returns a table with status and type fields.

I want to modify the first query somehow to run a subquery for each row by calling my macro and appending the fields to the final table.

Finally, I want to have a table with four fields: id, time, status, and type (where status and type were obtained by calling a subquery with id and time).

Is it possible?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @abroun,

probably this is the only case where join could be the best solution:

 

some-search 
| join type=left id [ search 
   some-search-index $id$ 
   | eval epoch = _time 
   | where epoch < $timestamp$ 
   | sort BY _time 
   | head 1 
   | fields id status type
   ]
| table id time status type

 

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @abroun,

to help you I need also the second search.

In few words, you have to correlate results from both the searches using stats BY common key.

Ciao.

Giuseppe

abroun
Engager

The second search (macro) is like:

some-search-index $id$ 
| eval epoch = _time 
| where epoch < $timestamp$ 
| sort BY _time 
| head 1 
| fields id, status, type
| table id, status, type
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @abroun,

probably this is the only case where join could be the best solution:

 

some-search 
| join type=left id [ search 
   some-search-index $id$ 
   | eval epoch = _time 
   | where epoch < $timestamp$ 
   | sort BY _time 
   | head 1 
   | fields id status type
   ]
| table id time status type

 

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...