Splunk Search

Filtering data for stats purpose

ripson
Engager

I am using Splunk 9.0.4 and I need to make a query where I extract data from a main search.
So I am interested in results from the main search:

 

stage=it sourcetype=some_type NOT trid="<null>" reqest="POST /as/*/auth *"

 



But then I need filter out results from the main search, using a subsearch that operates on a different data set, using a value from a field from the main search, let's call it trid, and trid is a string that might be part of a  value called message in a subsearch. There might be more results in the subsearch, but if there is at least one result in a subsearch then the result from the main search stays in the main search, if not it should not be included in the main search.

So I am interested only in the results from the main search, and the subsearch is only used to filter out some of them that does not match.

 

stage=it sourcetype=some_type NOT trid="<null>" reqest="POST /as/*/auth *"
| fields trid
[
    search stage=it sourcetype=another_type
    | eval matches_found=if(match(message, "ID=PASSLOG_" + trid), 1, 0)
    | stats max(matches_found) as matches_found
]
| where matches_found>0

 


After a few hours I cannot figure out how to make it. What is wrong with it? Please advise.

Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Subsearches execute before main searches (although there are exceptions), therefore trid from the main search is not available in the subsearch. However, you could try something like this

stage=it sourcetype=some_type NOT trid="<null>" reqest="POST /as/*/auth *"
[
    search stage=it sourcetype=another_type
    | rex field=message "ID=PASSLOG_(?<trid>\d+)"
    | stats count by trid
    | fields trid
]

Here I have assumed trid is numeric - if not, you should define a pattern that will allow rex to extract the trid from the message field

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Subsearches execute before main searches (although there are exceptions), therefore trid from the main search is not available in the subsearch. However, you could try something like this

stage=it sourcetype=some_type NOT trid="<null>" reqest="POST /as/*/auth *"
[
    search stage=it sourcetype=another_type
    | rex field=message "ID=PASSLOG_(?<trid>\d+)"
    | stats count by trid
    | fields trid
]

Here I have assumed trid is numeric - if not, you should define a pattern that will allow rex to extract the trid from the message field

0 Karma

ripson
Engager

Thank you so much! This is UUID actually but I have added a pattern and it works perfectly!

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...