Splunk Search

How to use the results of subsearch?

smanojkumar
Path Finder

My requirement is to utilize the results of the sub-search and use it with the results of the main search results, but the sourcetype/source is different for the main search and sub-search, Im not getting the excepted results when using format command or $field_name,


inputlookup host.csv - consists of list of hosts to be monitored

main search 

 

index=abc source=cpu sourcetype=cpu CPU=all
[| inputlookup host.csv ]
| eval host=mvindex(split(host,"."),0)
| stats avg(pctIdle) AS CPU_Idle by host
| eval CPU_Idle=round(CPU_Idle,0)
| eval warning=15, critical=10
| where CPU_Idle<=warning
| sort CPU_Idle

sub-search
[search index=abc source=top
| dedup USER
| return $USER]

 there is a field host , which is common in both, ,the events from index=abc source=cpu sourcetype=cpu does not contain a USER field, since the USER field is there when source=top, not in source=cpu

Labels (1)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What are you trying to achieve with the events from both searches? In what way are you trying to "utilise" the sub-search? Can you give an example of your expected / desired result?

0 Karma
Get Updates on the Splunk Community!

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...