Splunk Search

How to pass result from subsearch to main level

kaurinko
Communicator

Hi,

What I am trying to do, is to determine from a lookup table whether we have a maintenance window active in order to effectively disable a number of alerts. Excluding the log lines from the searches is not an option, because the alerts will interpret that as an error situation since the successfull cases would be missing. I already have a lookup table containing the start and end times for the maintenance windows.

The following produces promising results:

 

| inputlookup maintenancetimes.csv
| convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
| eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
| return 500 Break

 

The result is

 

(Break="Yes") OR (Break="")

 

Which I interpret as presence of both active and inactive maintenance windows. However, when I am trying to use the data from a subsearch, it isn't doing what I want.

 

| makeresults count=2 annotate=true
| eval IsBreak=if(match([
    | inputlookup maintenancetimes.csv
    | convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
    | eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
    | return 500 $Break ],"Yes"),1,0)
| table IsBreak _time

 

The results show 0 as the value of IsBreak, and I can't figure out why. The intention is of course to utilize this as a part of a more complicated search/alert.

What am I doing wrong?

Best regards,

Petri

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you take your search and substitute the subsearch with its results, you get this

| makeresults count=2 annotate=true
| eval IsBreak=if(match((Break="Yes") OR (Break=""),"Yes"),1,0)
| table IsBreak _time

which is not valid.  Try removing the match() function so the result is more like this.

| makeresults count=2 annotate=true
| eval IsBreak=if((Break="Yes") OR (Break=""),1,0)
| table IsBreak _time

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

kaurinko
Communicator

Hi,

Thanks for the suggestion. In the actual subsearch I am trying to use the result is passed with a $Break, not a bare Break. That returns in my test "Yes" and the match should return true and the IsBreak should be set to 1.

Looking at your suggestion, I have a hard time identifying how would it actually change the value of Break and ever return anything else than IsBreak=0.

Best regards,

Petri

0 Karma
Get Updates on the Splunk Community!

New in Observability - Improvements to Custom Metrics SLOs, Log Observer Connect & ...

The latest enhancements to the Splunk observability portfolio deliver improved SLO management accuracy, better ...

Improve Data Pipelines Using Splunk Data Management

  Register Now   This Tech Talk will explore the pipeline management offerings Edge Processor and Ingest ...

3-2-1 Go! How Fast Can You Debug Microservices with Observability Cloud?

Register Join this Tech Talk to learn how unique features like Service Centric Views, Tag Spotlight, and ...