Splunk Search

How to combine multiple search

msg4sunil
Path Finder

How do combine the below 2 searches into one?

1. * orderid|stats count by id

returns something like 

2022-03-21T00:10:16,999Z ...INFO [thread_id=12349, id=VU53ZQCTTMLPG, .....
2022-03-21T00:10:16,995Z....INFO [thread_id=549, id=F2PAC6ITNX6O3,

2. Based on the above response, I need to query as below after fetching the "id".  Note, "id's would vary for different orderid and the number of "id"'s would also vary 

id IN ("VU53ZQCTTMLPG","F2PAC6ITNX6O3")

 

Thank you

0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

@msg4sunil 

index=* [
  search index=* "985be6370637" 
  | stats count by id
  | fields id
]

It is not good practice to use index=* - admins do not like users who cast a wide search net - always be as specific as possible when making your search - particularly in this case, you are making two searches.

 

View solution in original post

bowesmana
SplunkTrust
SplunkTrust

There are a number of ways to do this, with subsearches, joins or aggregations, but it's not easy to give you an absolute solution.

The most obvious example from your description is the subsearch, which would be something like

Your second search [ 
  search your first search
  | stats count by id | fields id
]

which would pass the list of ids in the subsearch to the outer search which is effectively doing 

(id1 OR id=2 OR id=3..)

as part of the outer search

You can use other techniques, such as searching for all the data in a single search and then manipulating it with eval/stats to get to your desired output, but need more info on that.

join command is an option, but should rarely be the first choice, as 'join' has limitations and is not really the way to do this sort of task in Splunk world

 

0 Karma

msg4sunil
Path Finder

@bowesmana , can you please give one example?  The below doesnt work.

index=* id IN [index=* "985be6370637"| fields id]

0 Karma

bowesmana
SplunkTrust
SplunkTrust

@msg4sunil 

index=* [
  search index=* "985be6370637" 
  | stats count by id
  | fields id
]

It is not good practice to use index=* - admins do not like users who cast a wide search net - always be as specific as possible when making your search - particularly in this case, you are making two searches.

 

msg4sunil
Path Finder

Thank you very much @bowesmana for timely help.  Sure, will make the index name as explicit instead of using *.

Thanks again.

0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...