Splunk sub search

[Sriram]

I have a splunk query to combine 2 different results.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." ] | table "Statistics" 

I want the sub search results to be displayed only if "AvgRespTime" > 6, right now the inner sub query gets generated with results no matter what the "AvgRespTime" value is and getting printed. Any ideas ?

[somesoni2 · Accepted solution]

How about something like this.

index=applogs sourcetype=appsource "performance metrics"  | search "AvgRespTime" > 6| eval "Statistics"  = requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=1 | append [search index=applogs sourcetype=appsource "component metrics"  | eval "Statistics"  = componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds." | eval filter=-1 ] | eventstats max(filter) as filter | where filter =1 | table "Statistics"

[Sriram]

filter works ! Awesome ! thanks for your help.

[wpreston]

Your subsearch doesn't have the AvgRespTime>6 condition in it, so the subsearch will return events of all AvgRespTimes. Add that condition into your subsearch and it should work.

I'm thinking you might be able to refactor your search as well so that it doesn't need a subsearch at all. Would this work for you?

index=applogs sourcetype=appsource  "AvgRespTime" > 6 "performance metrics" OR "component metrics"     
| eval Statistics=if(searchmatch("performance metrics"), requestCount + " requests processed. Average Response Time = " + AvgRespTime + " seconds.", componentcount + " components processed. Average Response Time = " + AvgRespTime + " seconds.")
| table Statistics