Splunk Search

If I want to use a field from the main search as a search criteria for a sub-search, what code should I write?

hasegawaarte
Explorer

If I want to use a field(alarm_time) from the main search as a search criteria for a sub-search, what code should I write?
In the following code, I want to search for the time they are working 

I want to search Conditions : work_start < alarm_time < work_end 
search results you want to get : (work_name=work_b)
____________________________________

| makeresults
|eval _raw="alarm_time,host,message
2022/03/26 18:05,test_node,test_down"
| multikv forceheader=1
| eval alarm_time_strp = strptime(alarm_time,"%Y/%m/%d %H:%M")
| join type=left host
[| makeresults
|eval _raw="host,work_start,work_end,work_name
test_node,2022/03/26 17:00,2022/03/26 18:00,work_a
test_node,22022/03/26 18:00,2022/03/26 19:00,work_b
test_node,2022/03/26 19:00,2022/03/26 20:00,work_c"
| multikv forceheader=1
| eval work_start_strp = strptime(work_start,"%Y/%m/%d %H:%M")
| eval work_end_strp = strptime(work_end,"%Y/%m/%d %H:%M")
]
Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

In general case, you don't "pass parameters" to a subsearch. It's the other way around - the subsearch is evaluated first, its results are rendered to a condition or set of conditions which gets appended to the main search.

You can use the map command to launch a subsearch with parameters coming from the main search but it's for a very very rare cases.

As a rule of thumb you should avoid subsearches whenever you can - they have their limitations and can fail silently and fail you in a very nasty way.

Huge part of searches you'd initially try to write with subsearches (and joins) can be rewritten as stats.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

In general case, you don't "pass parameters" to a subsearch. It's the other way around - the subsearch is evaluated first, its results are rendered to a condition or set of conditions which gets appended to the main search.

You can use the map command to launch a subsearch with parameters coming from the main search but it's for a very very rare cases.

As a rule of thumb you should avoid subsearches whenever you can - they have their limitations and can fail silently and fail you in a very nasty way.

Huge part of searches you'd initially try to write with subsearches (and joins) can be rewritten as stats.

Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...