Splunk Search

Sub search not returning string

joeybroesky
Path Finder

Why does a sub search return a boolean value? I am expecting to see the department value.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return department])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

Search shown below:

alt text

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

View solution in original post

joeybroesky
Path Finder

Added format to the end of the sub search resolved the issue.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

manjunathmeti
Champion

That's great! I updated my answer so that it can help others looking for similar problem.

0 Karma

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

joeybroesky
Path Finder

This returns "Null" for From_Sub_Search instead of "True".

See accident answer below.

0 Karma

manjunathmeti
Champion

what is the output of index="activedirectory" (userPrincipalName="@emailaddress.ca") | fields department ?

0 Karma

joeybroesky
Path Finder

It return the raw event data. If I table "department" it is correct.

alt text

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...