Splunk Search
Highlighted

Subsearch based on if statement

Path Finder

I'm pretty new to this so if this is a newbie question I apologize.

I'm doing a search against a set of log files (i.e. xyz.log). Each event, or record, contains an operation id and a timestamp(down to millisecond), among other things. So, I need no more in the search, UNLESS, the operation is MOVE. If the operation is MOVE, then I need to search for events in another log (abc.log) that have nearly the same time stamp, say, within 500 milliseconds, and display as well.

Tags (4)
Highlighted

Re: Subsearch based on if statement

SplunkTrust
SplunkTrust

Sounds like a pattern that could be accomplished with transaction. http://www.splunk.com/base/Documentation/latest/SearchReference/Transaction

This would work best if there was some common value (other than time) linking the MOVE event to the abc.log events.

0 Karma
Highlighted

Re: Subsearch based on if statement

Legend

You can use subsearch. It is extremely common, but also not the most intuitive to write:

source=abc.log [ search source=xyz.log "MOVE" | earliest=_time-0.500 | latest=_time+0.500 | fields earliest,latest ]

There's no need for an if, as the conditional logic is implicit in your selection of looking for events containing MOVE.

A search like this is featured on the Splunk Mug, the "What were you doing around the time of the murders?" query.

Highlighted

Re: Subsearch based on if statement

Builder

So, how do we get a mug? This I can use! I have too many Splunk t-shirts that only seem to come in size L and are way to big for me. 🙂

0 Karma
Highlighted

Re: Subsearch based on if statement

Path Finder

Wouldn't this provide me with data for ONLY MOVE operations?

0 Karma
Highlighted

Re: Subsearch based on if statement

Path Finder

What I mean is, I need to have all operations from xyz.log displayed, not just MOVE operations, but should only need to grab data from abc.log if the operation is MOVE. Also, forgive my ignorance, but I get an error when using the syntax you provided. |earliest=mytimestampvar tells me it doesn't know what earliest is, same with latest.

0 Karma