Splunk Search

Kicking different searches

yuwtennis
Communicator

Hi!

I want to ask question if something like below can be implemented.

I have created 4 searches.

search A : creates a CSV file with outputcsv
search B : creates a CSV file using the csv from search A
search C : creates a CSV file using the csv from search A
search D : creates a CSV file using the csv from search A

So the call flow would be like,

search A -> search B
-> search C
-> search D

search B - D has to be called the in the stream of search A.

Is this possible?

Thanks,
Yu

Tags (1)
0 Karma
1 Solution

Ayn
Legend

You can use the fact that subsearches are run before the main search, so first of all run search A in a subsearch so that the CSV file exists, then use it in all your other searches.

searchB [search searchA | outputcsv ... | return ""] | outputcsv ... | append [search searchC | outputcsv ... ] | append [search searchD | outputcsv ... ]

View solution in original post

Ayn
Legend

You can use the fact that subsearches are run before the main search, so first of all run search A in a subsearch so that the CSV file exists, then use it in all your other searches.

searchB [search searchA | outputcsv ... | return ""] | outputcsv ... | append [search searchC | outputcsv ... ] | append [search searchD | outputcsv ... ]

yuwtennis
Communicator

Hello Ayn.

This looks nice. I will take a look at it.

Thanks,
Yu

0 Karma
Get Updates on the Splunk Community!

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...