Splunk Search

How to create alternative for subsearch?

Mike6960
Path Finder

I have a search with a subsearch. I run into the limitations of the maximum results (50.000)

Now Ia m trying to figure out to rebuild my search but I am stuck. Can anyone guide to the right direction?

My search now :

 <> index=TEST
| search logger="success - Metadata:*"
[ search index=TEST
| search logger="Response: OK]"
| fields message.messageId]
| stats dc(message.messageId)</>

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

sorry miscopy error:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| eval kind=if(logger="Response: OK","Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY message.messageId
| where kind_count=2

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

at first use  the search command after the main search only if you have some trasformation in the middle to use in the secondary search so you can have quicker searches.

then you have to find some value to identify differences.

If I correctly understood, you have to filter the results of the main search with the ones of the secondaryand you want only the message.messageId where there are both the logger values, is it correct?

in this case you could run something like this:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| eval kind=if(logger="Response: OK",logger="Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY message.messageId
| where kind_count=2

please see my approach and adapt it to your need.

Ciao.

Giuseppe

 

0 Karma

Mike6960
Path Finder

Hi @gcusello , I tried yor suggestion but I get the error:

Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

 

My example search was simplified for several reasons, is there a chance I use illegal characters or something?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

sorry miscopy error:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| eval kind=if(logger="Response: OK","Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY message.messageId
| where kind_count=2

Ciao.

Giuseppe

Mike6960
Path Finder

@gcusello  , thanks the error is now gone. But I get no results which is strange. I am gonna try to look what is causing this.

Maybe I should use 'transaction' because there are multiple kind of values for the logger not just the two

I need the events that are in both 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

maybe the problem is the field message.messageId, rename it or use quotes:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| rename message.messageId AS messageId
| eval kind=if(logger="Response: OK","Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY messageId
| where kind_count=2

Ciao.

Giuseppe

0 Karma

Mike6960
Path Finder

@gcusello  I think its because of the asterix I use in the logger. I read that this is not supported in the evalfunction....

0 Karma
Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...