Splunk Search

How to fit a subsearch in the middle of a search query

chaninphx
Path Finder

Hi everyone. How do I format this subsearch to work in my search query? I'm still fairly new to splunk

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | search "$drop_name$"="$text_name$*" [search "$drop_name$"="*$text_name$*" | where $drop_name$==description] | mvcombine sourcetype | sort index | table index sourcetype description
Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this. (updated per your last comment)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
 | where (("$drop_name$"="index" OR "$drop_name$"="sourcetype") AND like('$drop_name$',"$text_name$%") OR ("$drop_name$"="description" AND match(description,"$text_name$")
 | mvcombine sourcetype | sort index | table index sourcetype description

Essentially, if $drop_name$ is index/sourcetype, it checks full value else, does a match which checks if the values is 'contained' within description field in lookup.

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this. (updated per your last comment)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
 | where (("$drop_name$"="index" OR "$drop_name$"="sourcetype") AND like('$drop_name$',"$text_name$%") OR ("$drop_name$"="description" AND match(description,"$text_name$")
 | mvcombine sourcetype | sort index | table index sourcetype description

Essentially, if $drop_name$ is index/sourcetype, it checks full value else, does a match which checks if the values is 'contained' within description field in lookup.

0 Karma

chaninphx
Path Finder

Ok that worked! Thank you!

0 Karma

somesoni2
Revered Legend

cool. Don't forget to close the question by Accepting the answer.

0 Karma

somesoni2
Revered Legend

What is your requirement here? Could you provide details on different data sources you're using and available fields and relationship between them?

0 Karma

chaninphx
Path Finder

I'm using two csv files that link three fields together, the index, the sourcetypes from that index, and the description of those sourcetypes. I'm creating an app where you can search and find data for all three fields. However when the user selects that they want to find the description, I want it to find where description="$text_name$" instead of "$text_name$*" so it can be easier for the user to find the sourcetype that goes with their description if they only use one word to describe it.

0 Karma

somesoni2
Revered Legend

So the $drop_name$ and $test_name are the user input tokens (dropdown or textbox I'm guessing)? Why do you need a subsearch for that if you just want user to filter records based on their inputs.. Something like this should work just fine. (assuming $drop_name$ gives you column name (index/sourcetype/description) and $text_name$ gives the values to be searched)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
| where '$drop_name$'="$text_name$" AND match(description,"$text_name$")
| mvcombine sourcetype | sort index | table index sourcetype description
0 Karma

chaninphx
Path Finder

Thanks for your response somesoni2. So what I want to do is if $drop_name$ turns out to be index or sourcetype then i want the search to be $drop_name$="$text_name$". If it turns out that the user chose description for $drop_name$, I want it to search $drop_name$="$text_name$*". Hopefully it makes a little more sense.

0 Karma

chaninphx
Path Finder

Sorry i dont know why it won't put the wildcards in there but there should be one after $text_name$ for input and sourcetype, and then one before and after $text_name$ for description

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...