Adding data to the table from subsearch

[abroun]

Hey, I have a problem preparing a Splunjk query. Could you assist me?

I have a simple query that returns a table with a few fields:

some-search | fields id, time | table id, time

I also have a macro with two arguments (id and time) that returns a table with status and type fields.

I want to modify the first query somehow to run a subquery for each row by calling my macro and appending the fields to the final table.

Finally, I want to have a table with four fields: id, time, status, and type (where status and type were obtained by calling a subquery with id and time).

Is it possible?

[gcusello]

Hi @abroun,

to help you I need also the second search.

In few words, you have to correlate results from both the searches using stats BY common key.

Ciao.

Giuseppe

[abroun]

The second search (macro) is like:

some-search-index $id$ 
| eval epoch = _time 
| where epoch < $timestamp$ 
| sort BY _time 
| head 1 
| fields id, status, type
| table id, status, type

[gcusello · Accepted solution]

Hi @abroun,

probably this is the only case where join could be the best solution:

some-search 
| join type=left id [ search 
   some-search-index $id$ 
   | eval epoch = _time 
   | where epoch < $timestamp$ 
   | sort BY _time 
   | head 1 
   | fields id status type
   ]
| table id time status type

Ciao.

Giuseppe