Splunk Search

How do you pass a field into a subsearch?


There are a few other similar questions on Splunk answers, but each answer has been tailored to each asker's use case. I'm obviously also looking to get it answered for my use case, but I'd prefer answers that are also more broadly applicable to the community.

I have an exchange-based alert set up that looks for suspicious emails every three minutes and sends out an alert if one is found with the fields "sender message_subject recipient". I want to add a "seen_count" field that has a count of how many times we've seen that sender over all-time. Basically, I want to be able to do:

... <search> ... | table sender message_subject recipient | eval seen_count=[search index=msexchange event_id=DELIVER sender=$sender$ earliest=-999d latest=now | stats count | return $count]

Since you can't pass values into a subsearch, how do I do this elegantly? I could count ALL my exchange senders and then left join with that, or create daily reports that update an aggregate sender_count.csv file every day, but neither of those solutions are elegant.

0 Karma


Here's one answer... looking for a better one

<lengthy base search> | table sender message_subject recipient | join type=left sender [<lengthy base search copied and pasted> | table sender message_subject recipient | map search="search index=msexchange event_id=DELIVER sender=$sender$ earliest=-999d latest=now | eventstats count as seen_count | dedup sender | table sender seen_count"]
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...