Splunk Search

How to write a Subsearch to provide search criteria for outer search?

dmerrick
Observer

Hello, I am trying to do what i believe would be a correlated subquery. I need to search a file for a value, then re-search that same file for everything related to that value.

In a log file of all items and the messages produced as they are processed, I need to search for specific failure messages, grab the item that failed and re-search the file for all messages related to that item. 

What I currently have:
source="logs" host="test"

    [

       search source="logs" host="test" ("failed to subtract" OR "failed to add")

       |  rex "^[(?<item>[\w.-]+)\].+"   

       |  dedup item

       |  fields + item

   ] 

|  rex "^[(?<item>[\w.-]+)\]\s(?<message>.+)"

|  table _time, item, message

 

The inner [search] gives results on its own, but when placed as a subsearch, the whole provides no results.

Any help would be appreciated!

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

source="logs" host="test"
| rex "(?<failure>failed to subtract|failed to add)"
| rex "^\[(?<item>[\w.-]+)\].+"   
| eventstats values(failure) as failure by item
| where isnotnull(failure)
| rex "^\[(?<item>[\w.-]+)\]\s(?<message>.+)"
| table _time, item, message
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @dmerrick,

only one question:

you have the same search condition both in main and subsearch with the only difference of the strings condition in the subsearch, in other words: subsearch is a subset of the main search, 

so why don't you use only the subsearch as main?

source="logs" host="test" ("failed to subtract" OR "failed to add")
|  rex "^[(?<item>[\w.-]+)\].+"   
|  rex "^[(?<item>[\w.-]+)\]\s(?<message>.+)"
|  table _time, item, message

Then use always the index condition so you'll have faster searches.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...