Splunk Search

Can sampling for subsearches be used to parameterize main search?

amesbury
Engager

Is there a way to set sampling for subsearches separately from the main search? For example, given a search of a huge index (srcidx) like:

index=srcidx thirdparam=bar
    [ search index=srcidx param=foo
      | top 50 secondparam
      | fields secondparam
    ]
| top 50 result

The subsearch (looking for a specific value for param and returning to top 50 secondparam) in my data could be effective with a sampling rate of 1:10000, but the main search must not be sampled because I need real numbers. I see sampling can be controlled in dashboards' in SimpleXML, but I'm not sure <sampleRatio> can be set independently for subsearches.

Is there a way to adjust sampling ratios per search?

woodcock
Esteemed Legend

Yes, just add this to your subsearch SPL to do a 10% sampling:

... | noop sample_ratio=10

jacobpevans
Motivator

You could save the subsearch with the sampling set to whatever you want, then append using the savedsearch command.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/savedsearch

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...