Splunk Search

Sub search not returning string

joeybroesky
Path Finder

Why does a sub search return a boolean value? I am expecting to see the department value.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return department])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

Search shown below:

alt text

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

View solution in original post

joeybroesky
Path Finder

Added format to the end of the sub search resolved the issue.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

manjunathmeti
Champion

That's great! I updated my answer so that it can help others looking for similar problem.

0 Karma

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

joeybroesky
Path Finder

This returns "Null" for From_Sub_Search instead of "True".

See accident answer below.

0 Karma

manjunathmeti
Champion

what is the output of index="activedirectory" (userPrincipalName="@emailaddress.ca") | fields department ?

0 Karma

joeybroesky
Path Finder

It return the raw event data. If I table "department" it is correct.

alt text

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...