Splunk Search

Subquery - How can I modify format with multiple conditions?

emilep
Explorer

Hello,

The default format of my subsearch result looks like:

(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" ))

I would like to modify subsearch format result like:

(( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))



Do you think it is possible?

Regards,
Emile

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The format command is called either explicitly or implicitly at the end of the subsearch unless you return a field called "search". If your subsearch returns a "search" field, that value is directly substituted into the outer search.

So as long as you can manually craft such search string in your subsearch you can do it. The format command just makes it easy to handle typical case.

emilep
Explorer

As it exist some priority between AND and OR, it is right that the supplementary parentheses have no sense.
To solve my problem i used the command replace like this:

...|format|eval search = replace(search, "AND mid=", "OR mid=")

It is not perfect but it is working for now ...
Thanks for your help.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you realize that by doing so, you are changing semantics of the original subsearch?

Output of replaceEquivalent of original subsearch
(( Host_Name="srv1" AND icid="va1_icid1" OR mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" OR mid="val_mid2" ))

(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" ))

and

(( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))

That you need such a replacement means that the subsearch is incorrect for your purpose.  Usually revising the subsearch is a better option.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

In addition to semantic equivalence, there is often efficiency to be gained by converting an OR group to consecutive ANDs because true parallel processing is still a pipe dream for most compilers.  I suspect that's why the SPL compiler tries to optimize.

Why do you want to change format output, anyway?  If you want your search to be more semantic, you can write in any way you want.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It is not possible.  The format command (either implicit or explicit) is not that flexible.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...