Splunk Search

Extract a field and perform subsearch

mihirpradhan
Explorer

Hello,

I have this subsearch command:

[search source="local/data/user/logs/access*" status =5* | table request_id]

It gets the request_id's from the table and searches for them globally. I have a service file in which the request_id field is not extracted by default and gets excluded from search results. How can I make sure that the subsearch includes the results from the service file?

Here is my command to extract the request_id field from the service file

source="/home/user/logs/service*" | rex "Request\sID:\s(?<request_id>\w+)"

Thanks

0 Karma
1 Solution

gcusello
Legend

Hi @mihirpradhan,
you should stably extract the field using your regex in the field extractor (not using the rex command), in this way you'll have in props.conf

EXTRACT-Full-Before-After-Size-Time = Request\sID:\s(?<request_id>\w+)

then extend your subsearch to the other source, something like this:

your_main_search [search index=yur_index (source="local/data/user/logs/access*" status =5*) OR source="/home/user/logs/service*"| table request_id]
| ...

I hint to use always the index filter in your searches because they are faster.

Ciao.
Giuseppe

View solution in original post

gcusello
Legend

Hi @mihirpradhan,
you should stably extract the field using your regex in the field extractor (not using the rex command), in this way you'll have in props.conf

EXTRACT-Full-Before-After-Size-Time = Request\sID:\s(?<request_id>\w+)

then extend your subsearch to the other source, something like this:

your_main_search [search index=yur_index (source="local/data/user/logs/access*" status =5*) OR source="/home/user/logs/service*"| table request_id]
| ...

I hint to use always the index filter in your searches because they are faster.

Ciao.
Giuseppe

mihirpradhan
Explorer

Thank you. That worked beautifully!

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...