Lookup against Splunk Search

[rizzo75]

I need to run a search, then run another search to calculate a specific value. Almost like a lookup with splunk commands.

search ... | fields id count

for each event run: search ... id=$id$ | eval count=$count$ | ... calculations ... | stats sum(n) as N

The output would have all values:

id    | count | N
------------------------
111 | 222     | 333

What is the best way to achieve this?

Thanks,

Joe

[martin_mueller · Accepted solution]

Using your example, you could do this:

... | map maxsearches=42 [search ... id=$id$ | eval count = $count$ | ... calculations ... | stats sum(n) as N]

That'll give you up to 42 rows with a column N containing the sum. Depending on your calculations, it might be a lot faster to do something like this:

... | ... calculations, possibly involving some "by id" ... | stats sum(n) as N by id

[rizzo75]

I was able to achieve the necessary results using the map command, then joining back on the initial search.

earliest="-24h@h" latest="now" index=foo sourcetype=mysrc state=7 type!=9
| join type=outer usetime=True id [ search 
  index=foo sourcetype=mysrc state=7 type!=9
  | map maxsearches=500 search=" search
    index=bar sourcetype=othersrc … id = $id$
    | eval count=$count$
    | evals and such …
    | eval number=somenumber*othernumber
    | stats sum(number) as sum_number values(id) as id" ]

[musskopf]

Have a look on the map command... Provide some additional event data and expected results as vasanthmss mentioned to help writing the search.

[vasanthmss]

provide some sample events and expected result
If possible provide the search query you are running.