Splunk Search

Subquery - How can I modify format with multiple conditions?

emilep
Explorer

Hello,

The default format of my subsearch result looks like:

(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" ))

I would like to modify subsearch format result like:

(( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))



Do you think it is possible?

Regards,
Emile

0 Karma

PickleRick
SplunkTrust
SplunkTrust

The format command is called either explicitly or implicitly at the end of the subsearch unless you return a field called "search". If your subsearch returns a "search" field, that value is directly substituted into the outer search.

So as long as you can manually craft such search string in your subsearch you can do it. The format command just makes it easy to handle typical case.

emilep
Explorer

As it exist some priority between AND and OR, it is right that the supplementary parentheses have no sense.
To solve my problem i used the command replace like this:

...|format|eval search = replace(search, "AND mid=", "OR mid=")

It is not perfect but it is working for now ...
Thanks for your help.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Do you realize that by doing so, you are changing semantics of the original subsearch?

Output of replaceEquivalent of original subsearch
(( Host_Name="srv1" AND icid="va1_icid1" OR mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" OR mid="val_mid2" ))

(( Host_Name="srv1" AND icid="va1_icid1" AND mid="val_mid1" ) OR ( Host_Name="srv2" AND icid="va1_icid2" AND mid="val_mid2" ))

and

(( Host_Name="srv1" AND ( icid="va1_icid1" OR mid="val_mid1" )) OR ( Host_Name="srv2" AND ( icid="va1_icid2" OR mid="val_mid2" )))

That you need such a replacement means that the subsearch is incorrect for your purpose.  Usually revising the subsearch is a better option.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

In addition to semantic equivalence, there is often efficiency to be gained by converting an OR group to consecutive ANDs because true parallel processing is still a pipe dream for most compilers.  I suspect that's why the SPL compiler tries to optimize.

Why do you want to change format output, anyway?  If you want your search to be more semantic, you can write in any way you want.

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It is not possible.  The format command (either implicit or explicit) is not that flexible.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...