Is it possible to run subsearch per each event?

[gesman]

Is there a way to run custom subsearch per each event?
Pseudo: index=logs "error" | foreachevent [search index=extra_data | ... ] | ...
When few web hits within incoming traffic are red flagged - each such hit needs to be correlated with data at other indexes to enrich results with metadata.
Short of writing custom search command or forcing search query to generate another query dynamically - I don't know any more straightforward ways to make it happen.

[wpreston]

I think the map command is what you need. From the docs:

> Looping operator, performs a search over each search result

index=logs "error" | map search="search starttimeu::$start$ endtimeu::$end$" index=extra_data fieldIAmInterestedIn=$field$ | ... | stats over all results...

Try it out with an initial search that returns only a small amount of events first, as map can take quite a while to run if it has to run too many searches.

[vganjare]

Hi,

You can try the answer mentioned @ http://answers.splunk.com/answers/232781/find-all-events-of-type-x-that-do-not-have-an-even.html#ans...

Its possible to generate the dynamic query depending on subsearches.

Thanks!!