Splunk Search

Putting two search queries within and

New Member

Out of concern for performance, I need to put more than one search queries within same <query> and </query> block. One search query feeds the next using lookup writes and reads. Can I do that?

Tags (3)
0 Karma

Path Finder

Have you tried using an append command or using a subsearch?

Append Splunk Doc: http://docs.splunk.com/Documentation/Splunk/6.2.4/SearchReference/Append

SubSearch Splunk Doc: http://docs.splunk.com/Documentation/Splunk/6.2.4/Search/Aboutsubsearches#A_subsearch_example

You can also control the subsearch with settings in limits.conf for the runtime and maximum number of results returned.

0 Karma

SplunkTrust
SplunkTrust

If output of one search is input for 2nd one, you can just merge them into one big search.

0 Karma

New Member

I designed one 'big' search query but at the cost of performance (and elegance). Reason being two chunks of the search must be re-used twice implying that the search must be re-launched.

0 Karma

SplunkTrust
SplunkTrust

The thing you want to achieve requires sequencing of search queries as the lookup from 1st query should be populated before 2nd query should start. If the timerange/data for 1st query doesn't change very much drastically, you can schedule it to run frequently and update the lookup file. The 2nd query will just get the data from the latest scheduled run of the 1st query. Thoughts?

0 Karma

Champion

Why not use post process searches.

0 Karma