Splunk Search

How to use a value without including it in search results

w564432
Explorer

I am running a map command off of an initial search. The map ends with a sendemail command which sends a table of results.
I would like to send a message that computes totals and other stats on this table -- however, I would not like to include this data as a totals row the table/search results, only in the message.

In other words, the whole email would look something like:

Subject: Alert condition triggered

Sum(Field 1) of type X results: 524

    Table of results
    -----------------------------------------------
    | Field 1 | Field 2 | ...     
    ...
    ...
    ...

I know this can be done by running yet another subsearch for the "message" parameter in Splunk. However, this means I'm effectively running the same search twice... when performance-wise it would be better to just run the stats off of the table after it is generated. I know how to implement this in a dashboard with base searches, but I would like to know how to do this in 1 search. I think the problem is that there is no "scope" outside of the search results to which I can write a variable. I can think of a clunky solution using lookup/outputlookup.

Is there some way to maybe pipe the table into a separate subsearch that generates a variable/token but does not actually append to the main search?

0 Karma

woodcock
Esteemed Legend

The way that we did this was to run a base search and capture the SID using the addinfo command to get info_sid and then using |loadjob <SID here> in the other part of the search. This works great, except it makes the drilldown funky because it starts with | loadjob obscuring the base search.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...