How to fit a subsearch in the middle of a search query

[chaninphx]

Hi everyone. How do I format this subsearch to work in my search query? I'm still fairly new to splunk

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description | search "$drop_name$"="$text_name$*" [search "$drop_name$"="*$text_name$*" | where $drop_name$==description] | mvcombine sourcetype | sort index | table index sourcetype description

[somesoni2 · Accepted solution]

Try this. (updated per your last comment)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
 | where (("$drop_name$"="index" OR "$drop_name$"="sourcetype") AND like('$drop_name$',"$text_name$%") OR ("$drop_name$"="description" AND match(description,"$text_name$")
 | mvcombine sourcetype | sort index | table index sourcetype description

Essentially, if $drop_name$ is index/sourcetype, it checks full value else, does a match which checks if the values is 'contained' within description field in lookup.

[chaninphx]

Ok that worked! Thank you!

[somesoni2]

cool. Don't forget to close the question by Accepting the answer.

[somesoni2]

What is your requirement here? Could you provide details on different data sources you're using and available fields and relationship between them?

[chaninphx]

I'm using two csv files that link three fields together, the index, the sourcetypes from that index, and the description of those sourcetypes. I'm creating an app where you can search and find data for all three fields. However when the user selects that they want to find the description, I want it to find where description="$text_name$" instead of "$text_name$*" so it can be easier for the user to find the sourcetype that goes with their description if they only use one word to describe it.

[somesoni2]

So the $drop_name$ and $test_name are the user input tokens (dropdown or textbox I'm guessing)? Why do you need a subsearch for that if you just want user to filter records based on their inputs.. Something like this should work just fine. (assuming $drop_name$ gives you column name (index/sourcetype/description) and $text_name$ gives the values to be searched)

| inputlookup sourcetypes_raw.csv | lookup sourcetype_lookup.csv sourcetype OUTPUT description
| where '$drop_name$'="$text_name$" AND match(description,"$text_name$")
| mvcombine sourcetype | sort index | table index sourcetype description

[chaninphx]

Thanks for your response somesoni2. So what I want to do is if $drop_name$ turns out to be index or sourcetype then i want the search to be $drop_name$="$text_name$". If it turns out that the user chose description for $drop_name$, I want it to search $drop_name$="$text_name$*". Hopefully it makes a little more sense.

[chaninphx]

Sorry i dont know why it won't put the wildcards in there but there should be one after $text_name$ for input and sourcetype, and then one before and after $text_name$ for description