Splunk Search

How to obtain data from one search and store it in a variable to search data in another search?

paritoshs24
Path Finder

My search is  like  this 

index = idx source = src data_stamp = A  field1 = *lol* | table Field2   
--> This generates a column  with only value which i need to store in some $VAR

 

index = idx  source = src data_stamp = B field1 = *lol* TEST = $VAR | table field 3

 

Labels (4)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Splunk doesn't have variables.  One can use tokens in a dashboard for an equivalent function, but that's not available in SPL.

One alternative is a subsearch.  A subsearch runs first and its results become part of the main search.

index = idx  source = src data_stamp = B field1 = *lol* [ index = idx source = src data_stamp = A  field1 = *lol* | return TEST=Field2 ] | table field 3

In this example, the subsearch is in square brackets and runs the specified search.  The return command creates a result with the Field2 field renamed to TEST.  The main search then becomes 

index = idx  source = src data_stamp = B field1 = *lol* TEST=foo | table field 3
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Splunk doesn't have variables.  One can use tokens in a dashboard for an equivalent function, but that's not available in SPL.

One alternative is a subsearch.  A subsearch runs first and its results become part of the main search.

index = idx  source = src data_stamp = B field1 = *lol* [ index = idx source = src data_stamp = A  field1 = *lol* | return TEST=Field2 ] | table field 3

In this example, the subsearch is in square brackets and runs the specified search.  The return command creates a result with the Field2 field renamed to TEST.  The main search then becomes 

index = idx  source = src data_stamp = B field1 = *lol* TEST=foo | table field 3
---
If this reply helps you, Karma would be appreciated.

paritoshs24
Path Finder

Hi .... Its working...thanks for the help.
One  more thing to ad in subsearch :
Can I use IN command ??

index = idx  source = src data_stamp = B field1 = *lol* [ index = idx source = src data_stamp IN (A B)  field1 = *lol* | return TEST=Field2 ] | table field 3

 

I need to pass multiple values of data_stamp.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, the IN operator may be used in a subsearch.

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's worth pointing out that subsearches have their own limitations and - especially with big searches - are best avoided. The same result can quite often be achieved another way.

paritoshs24
Path Finder

Can you please point out how subsearch could be escaped ?

0 Karma

paritoshs24
Path Finder
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...