Splunk Search

How to pass the results of the first query into a second query based on a common field

bcronrath
Path Finder

I have an initial query that returns all instances of 500 internal errors in a log file. However, these entries have an ID that maps to a different log entry that does not have a result code setting, but contains the actual error that I need to view. If it helps, this is a quick visualization of how I am looking at the individual errors:

Step 1 - "Search for 500 errors across hosts"
Step 2 - "Grab a specific ID field from one of these entries that are returned
Step 3 - "Search across hosts for that specific ID"
Step 4 - "The single entry that I grabbed the ID for now shows the separate entry that has the actual error details"

My problem is that I can't afford to go through all of these 1 by 1, what I would like is to see all of the entries that have the actual error details (in other words I want to see a list of all the entries that Step 4 gives me above).

I had thought doing something like this:

result_code=500 | join c_id []

Would accomplish this, but that just returns an empty set.

Tags (2)
0 Karma
1 Solution

aweitzman
Motivator

It looks like a subsearch would be appropriate here:

sourcetype=hosts [search sourcetype=hosts result_code=500 | table c_id]

The subsearch goes through hosts and finds the c_id values for all of the entries with a result_code of 500. That list of c_id values is then applied to the main search as a big OR clause ( c_id=123 OR c_id=456 OR ... ), which ought to get you the results you want.

View solution in original post

aweitzman
Motivator

It looks like a subsearch would be appropriate here:

sourcetype=hosts [search sourcetype=hosts result_code=500 | table c_id]

The subsearch goes through hosts and finds the c_id values for all of the entries with a result_code of 500. That list of c_id values is then applied to the main search as a big OR clause ( c_id=123 OR c_id=456 OR ... ), which ought to get you the results you want.

mvaradarajam
Path Finder

Not working.....

0 Karma

aweitzman
Motivator

Could you please be more specific? What is the search you are running, and which part of it is not doing what you expect?

0 Karma
Get Updates on the Splunk Community!

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...

Stay Connected: Your Guide to October Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...