Splunk Search

Can't return subsearch results

souhei
Explorer

Hello, splunk community.

I tried to exec subsearch command for adding search condition of "main" search.
Datas of target of subsearch have single field named nameOfFruit.
example below,

apple
orange
pineapple
... and so on

I wrote search command like this,

 index=main [search index=sub | return nameOfFruit]

but it didn't work yet.

How should i write?
or can't i do this?

note:

Of course, before i ask this question, I found related articles below.
but any answer of these question didn't work well.

[How to return raw data results from subsearch query?]
http://answers.splunk.com/answers/172644/how-to-return-raw-data-results-from-subsearch-quer.html

[Appending search results with subsearch fields.]
http://answers.splunk.com/answers/170474/appending-search-results-with-subsearch-fields.html

[Filter search results based on return value of subsearch]
http://answers.splunk.com/answers/89845/filter-search-results-based-on-return-value-of-subsearch.htm...

[return command - exit (or return known value) if no results found]
http://answers.splunk.com/answers/89951/return-command-exit-or-return-known-value-if-no-results-foun...

1 Solution

kml_uvce
Builder

try this
index=main [search index=sub | table nameOfFruit]

kamal singh bisht

View solution in original post

0 Karma

souhei
Explorer

Hi kml_uvce.

Thanks in advance for your reply.

I tried the command suggested in your answer.
but, it didn't work.

I confirmed the command below worked well.

index=sub | table nameOfFruit

However, the commands below didn't work well...
#empty result was returned.

index=main [search index=sub | table nameOfFruit]
[search index=sub | table nameOfFruit]
0 Karma

souhei
Explorer

Thank you for your comment.

I tried your suggestion, then the command seemed to work well.
so... I might bark on the wrong tree.

Actually, This problem is just that result of main search command(including search condition of "sub" search result) return empty.

I'm sorry for trouble you.

0 Karma

MuS
Legend

Check the Job inspector where or why this fails

0 Karma

kml_uvce
Builder

try this
index=main [search index=sub | table nameOfFruit]

kamal singh bisht
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...