Retrieving results where field matches a list of fields in another search

[ericp56]

Hello,

Let me provide an explanation of what I am trying to do:

Here are some log entries. I put the field names above the entries, for this illustration:

session page result
1 A OK
1 B OK
1 C OK
2 A OK
2 C OK

I want my search return all entries for a session which contain the field "page" equal to B.

So based on the above entries, my result set would be

1 A OK
1 B OK
1 C OK


I will export the results so I can read through the logs, which may be 500-2000 lines per session.

A transaction might be OK - * | sort by session, _time | transaction session | page=A

but then I have all the events merged together like so:
1 A OK 1 B OK 1 C OK

The export is fine to read through

However, if I want to do further field analysis, how can I get the results to be per event, instead of unioned together per the transaction?

[sowings · Accepted solution]

Start with a search to find the page=B part:

index=yourindex sourcetype=logtype page=B

Tell Splunk you want the session ID:

index=yourindex sourcetype=logtype page=B | fields session

Then ask Splunk to take the results from this set and use them to seed another search. This is the "subsearch" mechanism--easy to spot when you see [ ].

index=yourindex sourcetype=logtype [ index=yourindex sourcetype=logtype page=B | fields session ]

This will result in a search term like: ( ( session=1 ) OR ( session=2 ) OR ( session=7) )

After that, you can do stats or transaction or whatever you like to get the events. Note that as it stands, the search will give you as many events per session, by as many matching sessions there are. Stats or some other command can help distill some of the results for you.

[ericp56]

Thanks! That's exactly what I needed.