Splunk Search

How do you perform a sub search over indexes?

Marinus
Communicator

I've recently split up my data into indexes and some of my searches that make use of sub searches are now breaking.

For example I previously did a

tag::host=esb* [search TestService | fields + transaction_id] | transaction transaction_id

To cater for the index change I did

index=test tag::host=esb* [search TestService | fields + transaction_id] | transaction transaction_id

No luck, I even stuck an index into the subsearch with no results.

What is the correct syntax?

Marinus

Tags (2)
1 Solution

Marinus
Communicator

I found a workaround. I'm using the internal index as an example.

index=_internal [search index=_internal | head 1000 | fields + user] | transaction user

View solution in original post

0 Karma

Marinus
Communicator

I found a workaround. I'm using the internal index as an example.

index=_internal [search index=_internal | head 1000 | fields + user] | transaction user
0 Karma

Ayn
Legend

I assume you want the subsearch to go against the test index as well. The subsearch runs on its own and returns its results to the outer search, so any search parameters you add to the outer search do not affect the subsearch. Add index=test in the subsearch instead and have it return what index it's operating on to the outer search so that it uses the same index. Llike this:

tag::host=esb* [search index=test TestService | fields transaction_id,index] | transaction transaction_id
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...