Subsearch in SPLUNK with the name of index

[SplunkDash]

Hello, 

I have a use case to get the index name from the field of one of the index/sourcetype and use that index name value to search the content of that index, but not getting any result. Here is what I did:

index =meta_info sourcetype=meta:info| search group_name=admingr AND spIndex_name=admin_audit

| eval getIndex=spIndex_name
| search index=getIndex

Any help will be highly appreciated, thank you!

[bowesmana]

Your search is a little odd - it seems you just want to search index=admin_audit - so what's the purpose of the index=meta_info part 

what's wrong with just

index=admin_audit

[SplunkDash]

@bowesmana @richgalloway;,

We have an index that contains the list of index names; so, one search is going to get the index name from that index; other search is going to search the events (or get the events) within that index. A very interesting use case. But customer wants it. 

[bowesmana · Accepted solution]

The you should use the index with list of indexes to search as the subsearch, i.e. put your meta search in the subsearch and it will return the index you want.

[ 
  | search index=meta_info sourcetype=meta:info
  | search group_name=admingr AND spIndex_name=admin_audit
  | rename spIndex_name as index
  | fields index
]

In the form above, it's totally hard coded, but I assume the spIndex_name= statement is variable.

[richgalloway]

The search command doesn't handle field names on both sides of the equals sign.  Use where, instead.

index =meta_info sourcetype=meta:info| search group_name=admingr AND spIndex_name=admin_audit
| eval getIndex=spIndex_name
| where index=getIndex

[SplunkDash]

Hey @richgalloway

Thank you for your quick response. But it's not working, not getting any result. Just to let you know  spIndex_name is the name of the index and also eval value getIndex is not returning the index name admin_audit.

[SplunkDash]

Hello @richgalloway 

getIndex should should return value admin_audit from the eval; search at the end should return the content/events  of the index admin_audit