Splunk Search

Subsearch returning 2 fields and evaluation needed on one

ramanjain1983
Path Finder

Hi Guys,

I am trying to do this scenario where a subsearch is called to retrieve 2 fields using regex out of which only one exists in the primary search. But I want to use the second field to later display it along with my other fields.

Ex:-

PrimarySearch [ search secondary | rex "(?P<FieldA>.*)" | rex "(?P<FieldB>.*)"| fields FieldA FieldB ] |  rex "(?P<FieldC>.*)" | table FieldA FieldB FieldC

Now the challenge is that primary search do not have any field with name FieldB and even the even does not have any occurance of values which is in FieldB so the outcome of the query is nil.

The moment when I remove FieldB from subsearch it works fine. I understand that subsearch should return one argument against which you should pull out data in primary search but can anyone please help in my case where the judgement should be made based on fieldA only but fieldB should be displayed in final table outcome.

Thanks in advance.

Tags (1)
1 Solution

ramanjain1983
Path Finder

Solved it using inner join. Thanks all.

View solution in original post

0 Karma

ramanjain1983
Path Finder

Solved it using inner join. Thanks all.

0 Karma

kristian_kolb
Ultra Champion

Yes, probably something like;

primary [secondary | rex FieldA | fields fieldA] | join FieldA [secondary | rex FieldB] | more stuff

There might be more elegant solutions. You can do a lot with stats 🙂

0 Karma

lguinn2
Legend

It would be very helpful to see the actual searches instead of "PrimarySearch" and "secondary". Also, I agree with Kristian - it sounds like join or something else might be a better option.

0 Karma

kristian_kolb
Ultra Champion

Without knowing what data you have, it's a bit hard to give good guidance. Have you invesigated any alternative route?

transaction, append, multisearch, or even join?

Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...