Splunk Search

Can sampling for subsearches be used to parameterize main search?

Engager

Is there a way to set sampling for subsearches separately from the main search? For example, given a search of a huge index (srcidx) like:

index=srcidx thirdparam=bar
    [ search index=srcidx param=foo
      | top 50 secondparam
      | fields secondparam
    ]
| top 50 result

The subsearch (looking for a specific value for param and returning to top 50 secondparam) in my data could be effective with a sampling rate of 1:10000, but the main search must not be sampled because I need real numbers. I see sampling can be controlled in dashboards' in SimpleXML, but I'm not sure <sampleRatio> can be set independently for subsearches.

Is there a way to adjust sampling ratios per search?

Esteemed Legend

Yes, just add this to your subsearch SPL to do a 10% sampling:

... | noop sample_ratio=10
0 Karma

Motivator

You could save the subsearch with the sampling set to whatever you want, then append using the savedsearch command.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/savedsearch

Cheers,
Jacob
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!