Splunk Search

Parse a value and then use that as new query to search?

zakirhere
New Member

Hi,

I have an unusual scenario for the data I am working with and would like to see if it's even possible to extract data this way. In brief, I parsed a value from my initial search query to a variable using rex and now I want to use only that value as new query instead of sub-query.

Workflow:

  1. Find all successful test runs for a suite (this is a long query)
  2. Find reporting_url via event on each run 
  3. Parse uuid from reporting_url (I used rex on raw data and saved it on variable like res_uuid)
  4. Search only that uuid as that has multiple test_id records showing count of Pass/Fail counts.
  5. (Eventually create a graph for the same)

Trying to make a simple example:

First query -> Gives test suite level record. Parse to get UUID value

Second query -> Independent query using that UUID and then use that for making graph. Please note that 2nd query results not linked with 1st query and sub-search will only give one record. 

 

 

(Apologies if it's a very common workflow but I was not able to search it easily)

 

Labels (4)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @zakirhere,

You can append the new UUID value to a lookup, your second search use that lookup for the graph.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

zakirhere
New Member

Lookup on that result only shows results from the parent level (meaning same result). I checked in other groups and looks like I have to use some external programming language to pass these variable values and start a new query.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...

Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform

Ready to make your IT operations smarter and more efficient? Discover how to automate Splunk alerts with Red ...