Splunk Search

How to create alternative for subsearch?

Mike6960
Path Finder

I have a search with a subsearch. I run into the limitations of the maximum results (50.000)

Now Ia m trying to figure out to rebuild my search but I am stuck. Can anyone guide to the right direction?

My search now :

 <> index=TEST
| search logger="success - Metadata:*"
[ search index=TEST
| search logger="Response: OK]"
| fields message.messageId]
| stats dc(message.messageId)</>

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

sorry miscopy error:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| eval kind=if(logger="Response: OK","Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY message.messageId
| where kind_count=2

Ciao.

Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

at first use  the search command after the main search only if you have some trasformation in the middle to use in the secondary search so you can have quicker searches.

then you have to find some value to identify differences.

If I correctly understood, you have to filter the results of the main search with the ones of the secondaryand you want only the message.messageId where there are both the logger values, is it correct?

in this case you could run something like this:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| eval kind=if(logger="Response: OK",logger="Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY message.messageId
| where kind_count=2

please see my approach and adapt it to your need.

Ciao.

Giuseppe

 

0 Karma

Mike6960
Path Finder

Hi @gcusello , I tried yor suggestion but I get the error:

Error in 'eval' command: Fields cannot be assigned a boolean result. Instead, try if([bool expr], [expr], [expr]).

 

My example search was simplified for several reasons, is there a chance I use illegal characters or something?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

sorry miscopy error:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| eval kind=if(logger="Response: OK","Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY message.messageId
| where kind_count=2

Ciao.

Giuseppe

Mike6960
Path Finder

@gcusello  , thanks the error is now gone. But I get no results which is strange. I am gonna try to look what is causing this.

Maybe I should use 'transaction' because there are multiple kind of values for the logger not just the two

I need the events that are in both 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Mike6960,

maybe the problem is the field message.messageId, rename it or use quotes:

index=TEST (logger="success - Metadata:*" OR logger="Response: OK")
| rename message.messageId AS messageId
| eval kind=if(logger="Response: OK","Response: OK","success - Metadata")
| stats dc(kind) AS kind_count values(logger) AS logger BY messageId
| where kind_count=2

Ciao.

Giuseppe

0 Karma

Mike6960
Path Finder

@gcusello  I think its because of the asterix I use in the logger. I read that this is not supported in the evalfunction....

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...