Splunk Search

Sub search not returning string

joeybroesky
Path Finder

Why does a sub search return a boolean value? I am expecting to see the department value.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return department])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

Search shown below:

alt text

Labels (2)
Tags (1)
0 Karma
1 Solution

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

View solution in original post

joeybroesky
Path Finder

Added format to the end of the sub search resolved the issue.

index="activedirectory" (userPrincipalName=*@emailaddress.ca)
| eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format])
| eval From_Department=tostring(department)
| table From_Sub_Search, From_Department

manjunathmeti
Champion

That's great! I updated my answer so that it can help others looking for similar problem.

0 Karma

manjunathmeti
Champion

try this:

index="activedirectory" (userPrincipalName=*@emailaddress.ca) | eval From_Sub_Search=tostring([search index="activedirectory" (userPrincipalName="*@emailaddress.ca") | return $department | format] ) | eval From_Department=tostring(department) | table From_Sub_Search, From_Department

joeybroesky
Path Finder

This returns "Null" for From_Sub_Search instead of "True".

See accident answer below.

0 Karma

manjunathmeti
Champion

what is the output of index="activedirectory" (userPrincipalName="@emailaddress.ca") | fields department ?

0 Karma

joeybroesky
Path Finder

It return the raw event data. If I table "department" it is correct.

alt text

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...