Splunk Search

Subsearch: Returning the results from the subsearch and outer/primary search simultaneously.

metersk
Path Finder

Is it possible to return the results from a subsearch alongside the results of the outer/primary search?

[search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg

Of course, I can run the subsearch portion as a separate query, but it would be nice to return the results along side the outer search. Is this possible?

1 Solution

ngatchasandra
Builder

Hi metersk,

Try with appendcols command like this :

`Your primary search' | join  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg  |appendcols  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid]

View solution in original post

ngatchasandra
Builder

Hi metersk,

Try with appendcols command like this :

`Your primary search' | join  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg  |appendcols  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid]

dwaddle
SplunkTrust
SplunkTrust

Um, "maybe", depending on your exact use case.

The canonical use case for a subsearch is to define a filter for the outer search. The subsearch runs and its output is transmogrified (via the format command) into SPL. So the output of a subsearch looks something like:

(  ( uid = AAA ) OR ( uid = BBB ) OR ( uid = CCC ) )

The output of the subsearch text-replaces the [ $SUBSEARCH ] part of the outer search. This isn't exactly useful for you "as search results" because it's been transformed. And because of the text-replacement approach, the subsearch MUST run to completion before the outer search can begin.

For some use cases with subsearches - where you're not trying to use a subsearch as a filter for the primary search, you might find the multisearch command useful:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multisearch

This lets you run multiple searches in parallel and return results simultaneously. However, as I understand your use case above this is probably not that useful in this example.

0 Karma
Get Updates on the Splunk Community!

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...

What’s New in Splunk Cloud Platform 9.1.2308?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2308! Analysts can ...