Splunk Search
Highlighted

How to append a subsearch where count < 50?

Contributor

Hello -
Any suggestions on how to append a subsearch where count < 50?

...|stats count | where count < 50 | append [search | rex max_match=1 "(?i)(?<testIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})" | lookup dnslookup clientip AS testIP]
0 Karma
Highlighted

Re: How to append a subsearch where count < 50?

Motivator

Try this,

search.... | eventstats count | where count < 50 | do the rex... 
0 Karma
Highlighted

Re: How to append a subsearch where count < 50?

SplunkTrust
SplunkTrust

Could you provide more information? You have a base search and want to append result of a subsearch only when base search have more than 50 events?

0 Karma
Highlighted

Re: How to append a subsearch where count < 50?

Contributor

Yup, you got it.

0 Karma
Highlighted

Re: How to append a subsearch where count < 50?

Contributor

So if it is < 50 events, the rex + lookup should run. if > 50 the rex+lookup shouldn't run...

0 Karma
Highlighted

Re: How to append a subsearch where count < 50?

SplunkTrust
SplunkTrust

Try this workaround

your base search  | appendpipe [| stats count | eval temp=1|append [ your subsearch ] 
| eventstats values(count) as count | where count<50 AND temp!=1]
0 Karma
Highlighted

Re: How to append a subsearch where count < 50?

Contributor

I have tried this but it doesn't seem to resolve the IPs or show the testIP field when the count is < 50. I have tested the base search and it does work. I will play around with it some more tomorrow.

index=hostcheck "host timed out" | appendpipe [| stats count | eval temp=1 | append [search index=hostcheck "host timed out"| rex max_match=1 "(?i)(?\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})"| lookup dnslookup clientip AS testIP]| eventstats values(count) as count | where count<50 AND temp!=1]

0 Karma
Highlighted

Re: How to append a subsearch where count < 50?

Contributor
index=hostcheck "host timed out" | appendpipe [| stats count | eval temp=1 | append [search index=hostcheck "host timed out"| rex max_match=1 "(?i)(?<testIP>\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})"| lookup dnslookup clientip AS testIP]| eventstats values(count) as count | where count<50 AND temp!=1]
0 Karma