How to use Subsearch to achieve this ?

[zacksoft_wf]

I have 2 Splunk SPLs
=====================
index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d
| fields comp_name,comp_role,account_name,local_gp,gp_name
| table comp_name,comp_role,account_name,local_gp,gp_name
=====================

The comp_name fields has values such as , 
AAAAA, BBBBB,  CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE
Basically I am looking for all the comp_names that the admin is on and copying the list to use in another SPL  to get the comp owners.

Second SPL :
===================
index=computer_admin  source=emp_card_details  sourcetype="something:db" C_NAME IN (AAAAA, BBBBB,  CCCCC, AFSGSH, GFDFDF, IUYTE, HGFDJ, ZZZZZ, YYYYYY, IIIIII, EEEEEE)
| eval arl=lower(C_NAME)
| stats values(asset_owner) by arl
===================

Can we use subsearch or any thing similar to get it done in on SPL ?
Any assistance ?

[SanjayReddy · Accepted solution]

Hi @zacksoft_wf 

can you try this 

index=computer_admin source=emp_card_details sourcetype="something:db"
| join type=left C_NAME
[| search index=computer_admin source=admin_priv sourcetype=prive:db account_name=admin earliest=-1d
| rename comp_name as C_NAME
| table C_NAME,comp_role,account_name,local_gp,gp_name]
| eval arl=lower(C_NAME)
| stats values(asset_owner) by arl

[zacksoft_wf]

@SanjayReddy The field name is C_NAME in one SPL and  comp_name is another SPL,
In that case will,  | join type=left C_NAME truly join the two data sets ?
Just curious, my understanding could be wrong here !

[SanjayReddy]

Hi @zacksoft_wf 

in sub search we are renaming  comp_name as C_NAME to match with data in main query
  then both sub search and main searches are joined by common field C_NAME 

[zacksoft_wf]

@SanjayReddy  Thanks Sanjay, this helps.
About the earliest=-1d  written in the inner SPL, does it mean , it will  force both the inner and outer query to run in the -1d time range , irrespective of the time range chosen in the search-bar ?

[SanjayReddy]

Hi @zacksoft_wf 

earliest=-1d only applicable to inner search 

main search will run on time frame that selected in time range picker 

if you want to run both searches on same time frame you can remove earliest=-1d from inner search 
then both searche will run as per time rangepicker time


---
If this reply helps you, an upvote/Karma would be appreciated.