Splunk Search

Subsearch only returns 1 value

Thuan
Explorer

The search below produces multiple values for c_ip

index=proxy*
| fields c_ip s_op d_ip r_host d_port cs_bytes cs_uri referer c_agent
| lookup RedSkyIOCip-Proxy Indicator AS d_ip OUTPUT Source ReferenceAttribution
| search Source=RedSkyIOC
| table _time c_ip d_ip Source ReferenceAttribution cs_uri referer c_agent

When it is modified to become a subsearch as below, the subsearch only returns 1 value for c_ip. What is not working?

index=in_index
[ search index=proxy

| fields c_ip s_op d_ip r_host d_port cs_bytes cs_uri referer c_agent
| lookup RedSkyIOCip-Proxy Indicator AS d_ip OUTPUT Source ReferenceAttribution
| search Source=RedSkyIOC
| dedup c_ip
| rename c_ip AS s_ip
| return s_ip ]
| table _time s_ip d_ip d_port action | sort s_ip

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

The return command defaults to returning a single value. Try replacing it with a field command.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...