Splunk Search

Filter search by subsearch values

ahcarpenter
Engager

Hi,

What's the best way to filter a search against a set of unique id's in a subsearch?


Currently, approaching it as such:

<events to filter against subsearch ids>
| join left subsearch_id 
| [search subsearch]

Though, it's returning a 1:1 set v. all primary search events that contain a matching id.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

There's no much to work with in the question, but perhaps this gives you an idea.

<events to filter against subsearch ids> [search subsearch | return 1000 subsearch_id]

The subsearch with return command returns a string of the type "(subsearch_id="foo" OR subsearch_id="bar")" which filters the events from the base search.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...