Splunk Search

Pass one field from multiple fields returned by subsearch

Murali2888
Communicator

Hi All,

I have a search query like below.

[search A | fields B,C] | search (D OR E) | fields F | table, B,C,F.

Search A returns two fields.
I need to pass the field C to the master search but still want to retain the field B for the final results.
The above query passes both fields B & C to the master search and hence the master search is not return any results.

Is there possible solution for this?

Thanks
Murali

0 Karma

pacrip
Path Finder

Hi Murali

I had alot of issues with my subsearches but i found the best way to get back multiple fields from from a subsearch was using Eval (making sure the results are returned using a field called 'query' (dont ask me why)) and then rexing out your fields from the result. Its not very elegant but it gives you visibility and control over the data you are returning.

Im not very good at written explanations so maybe a code example would help:

eval f=[search A | fields B,C | eval query=B+";"+C | table query ] | rex (insert splitting regex here) | search (D OR E) | fields F | table, B,C,F
0 Karma

Ayn
Legend

No. The subsearch emits a filter string containing all values for B and C. There's no separate "channel" where field values can be returned from a subsearch without having them emitted as a filter string. Depending on your exact scenario, you might want to look into using join, or if you have fairly static data, consider putting your B values in a lookup.

0 Karma

Murali2888
Communicator

thanks @Ayn. I have been using join till now for this query but that has performance impact, so I am exploring other options.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...