Splunk Search

Filter search by subsearch values



What's the best way to filter a search against a set of unique id's in a subsearch?

Currently, approaching it as such:

<events to filter against subsearch ids>
| join left subsearch_id 
| [search subsearch]

Though, it's returning a 1:1 set v. all primary search events that contain a matching id.

Labels (2)
0 Karma


There's no much to work with in the question, but perhaps this gives you an idea.

<events to filter against subsearch ids> [search subsearch | return 1000 subsearch_id]

The subsearch with return command returns a string of the type "(subsearch_id="foo" OR subsearch_id="bar")" which filters the events from the base search.

If this reply helps you, an upvote would be appreciated.
0 Karma