Splunk Search

Difference between outputs of same query as search and subsearch

ebarnhill
Engager

Noob here. Can anyone tell me why the following search:

search sourcetype=srt  | table serialNumber

will give me a one-column table of serial numbers as expected, while the same query in subsearch brackets

[search sourcetype=srt  | table serialNumber]

does not return the same table that I expect, but rather returns the full record?

Labels (1)
0 Karma
1 Solution

scelikok
Champion

Hi @ebarnhill,

Subsearch outputs are formatted as search string. In your case the result is 

serialNumber=serialNumber1 OR serialNumber=serialNumber2 OR ...

You can test the subsearch output by adding format command end of the normal search

search sourcetype=srt  | table serialNumber | format
If this reply helps you an upvote is appreciated.

View solution in original post

scelikok
Champion

Hi @ebarnhill,

Subsearch outputs are formatted as search string. In your case the result is 

serialNumber=serialNumber1 OR serialNumber=serialNumber2 OR ...

You can test the subsearch output by adding format command end of the normal search

search sourcetype=srt  | table serialNumber | format
If this reply helps you an upvote is appreciated.

View solution in original post

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.