Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Combine 2 searches that have a subsearch
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I want to get all events related to dnis=27159866
I can perform this by getting all the events with a sessionid or parentsessionid linked to the dnis=27159866
I have the following searches :
to get all events with a sessionid linked to the dnis=27159866
The subsearch will get all sessionid linked to dnis=27159866 and then the search looks for all events with those sessionid's.sourcetype=vxml [search dnis=27159866 | fields sessionid]
to get all events with a parentsessionid linked to the dnis=27159866
The subsearch will get all sessionid linked to dnis=27159866, put it in the parentsessionid field and then the search looks for all events with those parentsessionid's.sourcetype=vxml [search dnis=27159866 | eval parentsessionid=sessionid | fields parentsessionid]
How can I combine those 2 searches in one search ?
So events where sessionid OR parentsessionid is equal to a value returned from the subsearch.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is it correct, that both of your subsearches have the same results? The only difference i can see is that in the first subsearch everything you return is stored in the field called sessionid and in the second subsearch you retrieve the same results but rename it to parentsessionid?
Isn't it possible to combine this to something like this:
sourcetype=vxml [search dnis=27159866 | eval parentsessionid=sessionid | fields sessionid parentsessionid]
It might be possible that you have to play around with the format command, to ensure that the results of your subsearch are concatenated as ((sessionid=123 OR parentsessionid=123) OR (sessionid=345 OR parentsessionid=345)...).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
is it correct, that both of your subsearches have the same results? The only difference i can see is that in the first subsearch everything you return is stored in the field called sessionid and in the second subsearch you retrieve the same results but rename it to parentsessionid?
Isn't it possible to combine this to something like this:
sourcetype=vxml [search dnis=27159866 | eval parentsessionid=sessionid | fields sessionid parentsessionid]
It might be possible that you have to play around with the format command, to ensure that the results of your subsearch are concatenated as ((sessionid=123 OR parentsessionid=123) OR (sessionid=345 OR parentsessionid=345)...).
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes, I added the format and I get the result that i wanted.
sourcetype=vxml [search dnis=27159866 | eval parentsessionid=sessionid | fields sessionid parentsessionid
| format "(" "(" "OR" ")" "OR" ")"]
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If this solves your problem, please convert the comment to an answer and accept it. This will help others with similar problems in the future.
If this reply helps you, Karma would be appreciated.
Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps
What’s New in Splunk Observability – September 2025
Fun with Regular Expression - multiples of nine
