Splunk Search

Sub search not returning string

joeybroesky
Path Finder

Why does a sub search return a boolean value? I am expecting to see the department value.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return department])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

Search shown below:

alt text

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

View solution in original post

joeybroesky
Path Finder

Added format to the end of the sub search resolved the issue.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

manjunathmeti
Champion

That's great! I updated my answer so that it can help others looking for similar problem.

0 Karma

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

joeybroesky
Path Finder

This returns "Null" for From_Sub_Search instead of "True".

See accident answer below.

0 Karma

manjunathmeti
Champion

what is the output of index="activedirectory" (userPrincipalName="@emailaddress.ca") | fields department ?

0 Karma

joeybroesky
Path Finder

It return the raw event data. If I table "department" it is correct.

alt text

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...