Splunk Search

How to use subsearch with eval to execute a search containing another subsearch?

Gchouane
Engager

Hello,

I would like create a search based on variables.

My current search:

| stats count
| eval search="index=customer_details sourcetype="..." 
| eval search_id=if("$id_customer$"="*"," "," (id_customer=$id_customer$ OR operational_customer_number=$id_customer$) ")
| eval search_name=if("$name$"="*"," ","name=$name$")
| eval search_first_name=if("$first_name$"="*"," "," first_name=$first_name$ ")
| eval search_email=if("$email$"="*"," "," email_account=$email$ ")
| eval search_phone=if("$tel_no$"="*"," "," ( land_phone=$tel_no$ OR mobile_phone=$tel_no$)")
| eval search_order=if("$id_order$"="*"," "," [search (index=order (id_order=$id_order$)  | head 1  | fields id_customer | appendpipe [ .... ] | fields id_customer 
] ")
| eval search_request=if("$requestid$"="*"," ","[search index=request requestid=$requestid$ | head 1 | rename idclient as id_customer | fields id_customer | appendpipe [ ....... ] | fields id_customer ]")
| eval search= search+search_id+search_first_name + search_name + search_phone + search_order + search_request
| fields search

If i execute this search with parameters, Splunk returns a field : search named "search_return"
If i execute "search_return" manually, it runs ok, but i want to execute this search directly.

Have you an idea ?

Thanks you

Tags (3)
0 Karma

vganjare
Builder

HI,

Can you try using return command, to return the field value rather than field itself? Something like return $search.

Thanks!!

0 Karma

vganjare
Builder

Hi,

Will it be possible for you create a simple example using _internal index? Explain the use-case using _internal idex as reference.

Thanks!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...