Splunk Search

Extract a field and perform subsearch

mihirpradhan
Explorer

Hello,

I have this subsearch command:

[search source="local/data/user/logs/access*" status =5* | table request_id]

It gets the request_id's from the table and searches for them globally. I have a service file in which the request_id field is not extracted by default and gets excluded from search results. How can I make sure that the subsearch includes the results from the service file?

Here is my command to extract the request_id field from the service file

source="/home/user/logs/service*" | rex "Request\sID:\s(?<request_id>\w+)"

Thanks

0 Karma
1 Solution

gcusello
Legend

Hi @mihirpradhan,
you should stably extract the field using your regex in the field extractor (not using the rex command), in this way you'll have in props.conf

EXTRACT-Full-Before-After-Size-Time = Request\sID:\s(?<request_id>\w+)

then extend your subsearch to the other source, something like this:

your_main_search [search index=yur_index (source="local/data/user/logs/access*" status =5*) OR source="/home/user/logs/service*"| table request_id]
| ...

I hint to use always the index filter in your searches because they are faster.

Ciao.
Giuseppe

View solution in original post

gcusello
Legend

Hi @mihirpradhan,
you should stably extract the field using your regex in the field extractor (not using the rex command), in this way you'll have in props.conf

EXTRACT-Full-Before-After-Size-Time = Request\sID:\s(?<request_id>\w+)

then extend your subsearch to the other source, something like this:

your_main_search [search index=yur_index (source="local/data/user/logs/access*" status =5*) OR source="/home/user/logs/service*"| table request_id]
| ...

I hint to use always the index filter in your searches because they are faster.

Ciao.
Giuseppe

mihirpradhan
Explorer

Thank you. That worked beautifully!

0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...