Splunk Search

Passing values from subsearch to Parent Search

ashvinpandey
Contributor

I am stuck with a query where I am trying to pass the field value from sub search to parent search:

Query: 

 

index=f5 sourcetype="*f5*" earliest=-1d@d latest=d@d
[| inputlookup user where country="US" | fields UserName | rename user_name ]

 

Explanation: The field name which is going to match from the subsearch is the user_name, now in the parent search there are two fields for user that is user_name and Account_name and i need both of them in the end result (user_name contains internal users/ Account_name contains external users).
I tried using coalesce to merge both the fields in the parent search but eval pops an error.

Can anyone please help me in solving this problem ?

Labels (2)
Tags (1)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

Hi @ashvinpandey 
i am not sure if i understand your problem correctly... but, still... i think this should be helpful to your problem...

index=f5 sourcetype="*f5*" earliest=-1d@d latest=d@d
[| inputlookup user where country="US" | fields UserName | rename UserName as user_name | return user_name ]

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not exactly sure what you're trying to achieve. What should the subsearch resolve to?

user_name="internal_user" AND Account_name="external-user"

Just do your subsearch to include those two fields. If it's the same value, just add

| eval Account_name=user_name

at the end of your subsearch.

If they are supposed to have different values, you have to look them up of course on their own. Can't tell you how though without knowing the lokup and its structure.

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...