How to pass result from subsearch to main level

[kaurinko]

Hi,

What I am trying to do, is to determine from a lookup table whether we have a maintenance window active in order to effectively disable a number of alerts. Excluding the log lines from the searches is not an option, because the alerts will interpret that as an error situation since the successfull cases would be missing. I already have a lookup table containing the start and end times for the maintenance windows.

The following produces promising results:

| inputlookup maintenancetimes.csv
| convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
| eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
| return 500 Break

The result is

(Break="Yes") OR (Break="")

Which I interpret as presence of both active and inactive maintenance windows. However, when I am trying to use the data from a subsearch, it isn't doing what I want.

| makeresults count=2 annotate=true
| eval IsBreak=if(match([
    | inputlookup maintenancetimes.csv
    | convert timeformat="%Y/%m/%d %H:%M:%S %p" mktime(MaintStart) mktime(MaintEnd)
    | eval Break=if( now() > MaintStart AND now() < MaintEnd, "Yes", "") | sort -Break
    | return 500 $Break ],"Yes"),1,0)
| table IsBreak _time

The results show 0 as the value of IsBreak, and I can't figure out why. The intention is of course to utilize this as a part of a more complicated search/alert.

What am I doing wrong?

Best regards,

Petri

[richgalloway]

If you take your search and substitute the subsearch with its results, you get this

| makeresults count=2 annotate=true
| eval IsBreak=if(match((Break="Yes") OR (Break=""),"Yes"),1,0)
| table IsBreak _time

which is not valid.  Try removing the match() function so the result is more like this.

| makeresults count=2 annotate=true
| eval IsBreak=if((Break="Yes") OR (Break=""),1,0)
| table IsBreak _time

[kaurinko]

Hi,

Thanks for the suggestion. In the actual subsearch I am trying to use the result is passed with a $Break, not a bare Break. That returns in my test "Yes" and the match should return true and the IsBreak should be set to 1.

Looking at your suggestion, I have a hard time identifying how would it actually change the value of Break and ever return anything else than IsBreak=0.

Best regards,

Petri