Primary search is suppressing results to secondary search .

[mukulraghuram]

Hi Experts,

I am trying to find a string pattern "a word" in the primary search from source="123.log" and then from time line of each pattern matching event, i would like to display some 20 events from a different source="456.log", prior to the time of events found from source="123.log".
Even join and other subsearches did not help.
As shown below, the Primary search is suppressing results to secondary search .

index=index1 source="123.log" <pattern to find>
|eval  date_x=strftime(_time,"%m/%d/%Y:%H:%M:%S")
|streamstats count
|where count>0
|search index=index1 source="456.log" earliest=date_x|top limit=20 source

Please help.

Thank you.

[richgalloway]

There is no "suppression" happening. Splunk is merely finding what you tell it to find. The main search returns only events from source "123.log", which means there are no events from source "456.log" for the search command to find.
Using the matching event's time as earliest in the second search will find events that came after the matching event, not before.
streamstats count followed by where count > 0 is meaningless. If any events are returned by the main search then count will always be non-zero; if no results are returned then there's nothing to count.
You say "display some 20 events" - does that mean the first 20, top 20, or something else?

Try this to see if it does what you want. It uses the map command to iterate over all events found in 123.log. Adjust how date_x is computed to control how far before the matching event you want to search.

index=index1 source="123.log" <pattern to find>
|eval  date_x=_time-60
|map search="search index=index1 source="456.log" earliest=$date_x$ latest=$_time$ | head 20"

[mukulraghuram]

Hi richgalloway,

Thank you.
What changes are needed if we have multiple source files and want to extract 20 events from each file.
The following combines both the sources and returns 20 events from one file or partial events from both the files.
Please suggest.

|map search="search index=index1 source="456.log" OR source ="789.log" latest=$date_x$ | head 20"

Regards

[richgalloway]

If you need results from each file then you need to search each file. Use two map commands.

|map search="search index=index1 source="456.log" latest=$date_x$ | head 20"
|map search="search index=index1 source ="789.log" latest=$date_x$ | head 20"