Splunk Search
Highlighted

Is it possible to run subsearch per each event?

Communicator

Is there a way to run custom subsearch per each event?
Pseudo: index=logs "error" | foreachevent [search index=extra_data | ... ] | ...
When few web hits within incoming traffic are red flagged - each such hit needs to be correlated with data at other indexes to enrich results with metadata.
Short of writing custom search command or forcing search query to generate another query dynamically - I don't know any more straightforward ways to make it happen.

Tags (1)
0 Karma
Highlighted

Re: Is it possible to run subsearch per each event?

Builder

Hi,

You can try the answer mentioned @ http://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html#ans...

Its possible to generate the dynamic query depending on subsearches.

Thanks!!

0 Karma
Highlighted

Re: Is it possible to run subsearch per each event?

Motivator

I think the map command is what you need. From the docs:

> Looping operator, performs a search over each search result

index=logs "error" | map search="search starttimeu::$start$ endtimeu::$end$" index=extra_data fieldIAmInterestedIn=$field$ | ... | stats over all results...

Try it out with an initial search that returns only a small amount of events first, as map can take quite a while to run if it has to run too many searches.