Splunk Search

Subsearch behavior missunderstanding

Micmac
Path Finder

Hello,

I have a behavior that I don't understand yet.

The search string below give me the expected results :

search sourcetype=sourcetype_1
| where ...
| stats count ...
| fields Date,sourcetype,host,msg

And the same execute as a subsearch doesn't show anything :

([search sourcetype=sourcetype_1
| where ...
| stats count ...
| fields Date,sourcetype,host,msg])

My goal is to queue different search and gathering in the same search string such as below :

 ([search sourcetype=sourcetype_1
    | where ...
    | stats count ...
    | fields Date,sourcetype,host,msg])
OR 
 ([search sourcetype=sourcetype_2
    | where ...
    | stats count ...
    | fields Date,sourcetype,host,msg])
OR
 ([search sourcetype=sourcetype_3
    | where ...
    | stats count ...
    | fields Date,sourcetype,host,msg])

Thanks for your help,

Tags (1)
0 Karma

somesoni2
Revered Legend

I am not sure if I fully understand your requirement here. Subsearches are basically parameters to main search to filter data from it. You can't use them to add result to main search. Based on your example, I am guessing you want to consolidate data from different searches (returning same fields) into one big search. For that you can try append command as following:

sourcetype=sourcetype_1
    | where ...
    | stats count ...
    | fields Date,sourcetype,host,msg
| append [search sourcetype=sourcetype_2
    | where ...
    | stats count ...
    | fields Date,sourcetype,host,msg]
| append [search sourcetype=sourcetype_3
    | where ...
    | stats count ...
    | fields Date,sourcetype,host,msg]

OR if the where and stats conditions are same in all three search (including field names), you can do like this

sourcetype=sourcetype_1 OR sourcetype=sourcetype_2 OR sourcetype=sourcetype_3 
 | where ...
    | stats count ...
    | fields Date,sourcetype,host,msg

somesoni2
Revered Legend

Are where condition and stats command same for all three queries?

0 Karma

Micmac
Path Finder

The append command works for my case !
But this seems not compatible with real time...

Thanks,

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!