Splunk Search

How to pass result from subsearch to main level

kaurinko
Path Finder

Hi,

What I am trying to do, is to determine from a lookup table whether we have a maintenance window active in order to effectively disable a number of alerts. Excluding the log lines from the searches is not an option, because the alerts will interpret that as an error situation since the successfull cases would be missing. I already have a lookup table containing the start and end times for the maintenance windows.

The following produces promising results:

 

| inputlookup maintenancetimes.csv
| convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
| eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
| return 500 Break

 

The result is

 

(Break="Yes") OR (Break="")

 

Which I interpret as presence of both active and inactive maintenance windows. However, when I am trying to use the data from a subsearch, it isn't doing what I want.

 

| makeresults count=2 annotate=true
| eval IsBreak=if(match([
    | inputlookup maintenancetimes.csv
    | convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
    | eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
    | return 500 $Break ],"Yes"),1,0)
| table IsBreak _time

 

The results show 0 as the value of IsBreak, and I can't figure out why. The intention is of course to utilize this as a part of a more complicated search/alert.

What am I doing wrong?

Best regards,

Petri

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you take your search and substitute the subsearch with its results, you get this

| makeresults count=2 annotate=true
| eval IsBreak=if(match((Break="Yes") OR (Break=""),"Yes"),1,0)
| table IsBreak _time

which is not valid.  Try removing the match() function so the result is more like this.

| makeresults count=2 annotate=true
| eval IsBreak=if((Break="Yes") OR (Break=""),1,0)
| table IsBreak _time

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

kaurinko
Path Finder

Hi,

Thanks for the suggestion. In the actual subsearch I am trying to use the result is passed with a $Break, not a bare Break. That returns in my test "Yes" and the match should return true and the IsBreak should be set to 1.

Looking at your suggestion, I have a hard time identifying how would it actually change the value of Break and ever return anything else than IsBreak=0.

Best regards,

Petri

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...