Splunk Search

Subsearch: Returning the results from the subsearch and outer/primary search simultaneously.

metersk
Path Finder

Is it possible to return the results from a subsearch alongside the results of the outer/primary search?

[search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg

Of course, I can run the subsearch portion as a separate query, but it would be nice to return the results along side the outer search. Is this possible?

1 Solution

ngatchasandra
Builder

Hi metersk,

Try with appendcols command like this :

`Your primary search' | join  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg  |appendcols  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid]

View solution in original post

ngatchasandra
Builder

Hi metersk,

Try with appendcols command like this :

`Your primary search' | join  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid] earliest=-14d@d latest=-0d@d ns=email msg=email_unsub_click | stats count by msg  |appendcols  [search earliest=-14d@d latest=-0d@d (ns=email msg=send gender=f  tid=*74) OR (msg=eis direction=sent gender=f) | transaction uid startswith=(msg="eis") maxspan=60m | eval emailsReceived = eventcount - 1 | where emailsReceived > 15 | fields uid]

dwaddle
SplunkTrust
SplunkTrust

Um, "maybe", depending on your exact use case.

The canonical use case for a subsearch is to define a filter for the outer search. The subsearch runs and its output is transmogrified (via the format command) into SPL. So the output of a subsearch looks something like:

(  ( uid = AAA ) OR ( uid = BBB ) OR ( uid = CCC ) )

The output of the subsearch text-replaces the [ $SUBSEARCH ] part of the outer search. This isn't exactly useful for you "as search results" because it's been transformed. And because of the text-replacement approach, the subsearch MUST run to completion before the outer search can begin.

For some use cases with subsearches - where you're not trying to use a subsearch as a filter for the primary search, you might find the multisearch command useful:

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Multisearch

This lets you run multiple searches in parallel and return results simultaneously. However, as I understand your use case above this is probably not that useful in this example.

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...