Splunk Search

Is it possible to run subsearch per each event?


Is there a way to run custom subsearch per each event?
Pseudo: index=logs "error" | foreachevent [search index=extra_data | ... ] | ...
When few web hits within incoming traffic are red flagged - each such hit needs to be correlated with data at other indexes to enrich results with metadata.
Short of writing custom search command or forcing search query to generate another query dynamically - I don't know any more straightforward ways to make it happen.

Tags (1)
0 Karma


I think the map command is what you need. From the docs:

> Looping operator, performs a search over each search result

index=logs "error" | map search="search starttimeu::$start$ endtimeu::$end$" index=extra_data fieldIAmInterestedIn=$field$ | ... | stats over all results...

Try it out with an initial search that returns only a small amount of events first, as map can take quite a while to run if it has to run too many searches.



You can try the answer mentioned @ http://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html#ans...

Its possible to generate the dynamic query depending on subsearches.


0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...