Splunk Search

How do you pass a field into a subsearch?


There are a few other similar questions on Splunk answers, but each answer has been tailored to each asker's use case. I'm obviously also looking to get it answered for my use case, but I'd prefer answers that are also more broadly applicable to the community.

I have an exchange-based alert set up that looks for suspicious emails every three minutes and sends out an alert if one is found with the fields "sender message_subject recipient". I want to add a "seen_count" field that has a count of how many times we've seen that sender over all-time. Basically, I want to be able to do:

... <search> ... | table sender message_subject recipient | eval seen_count=[search index=msexchange event_id=DELIVER sender=$sender$ earliest=-999d latest=now | stats count | return $count]

Since you can't pass values into a subsearch, how do I do this elegantly? I could count ALL my exchange senders and then left join with that, or create daily reports that update an aggregate sender_count.csv file every day, but neither of those solutions are elegant.

0 Karma


Here's one answer... looking for a better one

<lengthy base search> | table sender message_subject recipient | join type=left sender [<lengthy base search copied and pasted> | table sender message_subject recipient | map search="search index=msexchange event_id=DELIVER sender=$sender$ earliest=-999d latest=now | eventstats count as seen_count | dedup sender | table sender seen_count"]
0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...