Splunk Search

Subsearch Passback

steven10172
Explorer

I have the following sub-search:

index=voice "ani" "8005558508"
| rex field=_raw "{\"ani\",\"(?<ani>\d*)\"}"
| rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
| where ani="8005558508" | fields vdu | table vdu | sort _time | head 1

And I would like to them port the results of vdu into another search. The issue I'm having is that I only need the value of vdu and not the key pair. If the above search returns 53ed0055005700000a54907d232e0002 I need to then pass that into a search of this nature:

index=voice "53ed0055005700000a54907d232e0002"

What's the best way to go about this?

I tried using Map and the following, but neither seemed to work.

index=voice [search index=voice "ani" "8005558508"
| rex field=_raw "{\"ani\",\"(?<ani>\d*)\"}"
| rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
| where ani="8005558508" | fields vdu | table vdu | sort _time | head 1]
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=voice [search index=voice "ani" "8005558508"
| rex field=_raw "{\"ani\",\"(?<ani>\d*)\"}"
| where ani="8005558508"
| rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
| table vdu | sort _time | head 1| eval search=vdu | return search]

Update:

Same method with little performance enhancement

index=voice [search index=voice  "{\"ani\",\"8005558508\"}"   
    | rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
    | stats first(vdu) as search | return search]

Alternative with map

index=voice  "{\"ani\",\"8005558508\"}"   
        | rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
        | stats first(vdu) as vdu | map maxsearches=1 search="search index=voice \"$vdu$\""

OR (with original search)

index=voice "ani" "8005558508"
    | rex field=_raw "{\"ani\",\"(?<ani>\d*)\"}"
    | where ani="8005558508"
    | rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
    | table vdu | sort _time | head 1 | map maxsearches=1 search="search index=voice \"$vdu$\""

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

index=voice [search index=voice "ani" "8005558508"
| rex field=_raw "{\"ani\",\"(?<ani>\d*)\"}"
| where ani="8005558508"
| rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
| table vdu | sort _time | head 1| eval search=vdu | return search]

Update:

Same method with little performance enhancement

index=voice [search index=voice  "{\"ani\",\"8005558508\"}"   
    | rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
    | stats first(vdu) as search | return search]

Alternative with map

index=voice  "{\"ani\",\"8005558508\"}"   
        | rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
        | stats first(vdu) as vdu | map maxsearches=1 search="search index=voice \"$vdu$\""

OR (with original search)

index=voice "ani" "8005558508"
    | rex field=_raw "{\"ani\",\"(?<ani>\d*)\"}"
    | where ani="8005558508"
    | rex field=_raw "{\"vdu_id\",\"(?<vdu>.*?)\"}"
    | table vdu | sort _time | head 1 | map maxsearches=1 search="search index=voice \"$vdu$\""

View solution in original post

0 Karma

somesoni2
Revered Legend

I was missing 'search' keyword there. Try the updated answer now.

0 Karma

steven10172
Explorer

For the alternate with map I get the following error: Unable to run query 'index=voice "53eddd6b000000000ac3b89223310002"'.

But if I manually run that query everything runs fine

0 Karma

somesoni2
Revered Legend

I think it doesn't have the same timeout. Try the updated answers.

0 Karma

steven10172
Explorer

Does Map also have the same timeout as a subsearch? If not, is there a way to do this via the map command?

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!