Splunk Search

Adding data to the table from subsearch

abroun
Engager

Hey, I have a problem preparing a Splunjk query. Could you assist me?

I have a simple query that returns a table with a few fields:

 

 

some-search | fields id, time | table id, time

 

 


I also have a macro with two arguments (id and time) that returns a table with status and type fields.

I want to modify the first query somehow to run a subquery for each row by calling my macro and appending the fields to the final table.

Finally, I want to have a table with four fields: id, time, status, and type (where status and type were obtained by calling a subquery with id and time).

Is it possible?

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @abroun,

probably this is the only case where join could be the best solution:

 

some-search 
| join type=left id [ search 
   some-search-index $id$ 
   | eval epoch = _time 
   | where epoch < $timestamp$ 
   | sort BY _time 
   | head 1 
   | fields id status type
   ]
| table id time status type

 

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @abroun,

to help you I need also the second search.

In few words, you have to correlate results from both the searches using stats BY common key.

Ciao.

Giuseppe

abroun
Engager

The second search (macro) is like:

some-search-index $id$ 
| eval epoch = _time 
| where epoch < $timestamp$ 
| sort BY _time 
| head 1 
| fields id, status, type
| table id, status, type
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @abroun,

probably this is the only case where join could be the best solution:

 

some-search 
| join type=left id [ search 
   some-search-index $id$ 
   | eval epoch = _time 
   | where epoch < $timestamp$ 
   | sort BY _time 
   | head 1 
   | fields id status type
   ]
| table id time status type

 

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...