Splunk Search

Subsearch to only return multiple field values

SailorManDan
Explorer

Hello,

 

I am trying to only return the values of certain fields to be used in a subsearch. The problem I'm encountering, is that I have multiple values from different fields which I want to extract.

I have 4 fields - src, src_port, dst, dst_port

If I table out the results and use format, my search reads as such:

"src"="<IP>" AND "src_port"="<port>" AND "dst"="<IP>" AND "dst_port"="<port>" 

What I want is only the values:

"<ip>" AND "<port>" AND "<ip>" AND "<port>"

I've tried using:
return 10 $src $src_port $dst $dst_port
which gives me the desired output, but encases the entire output in one set of quotations and not individually as per the same output that would be created using the table command

I've also tried using:

eval query = src. " " .src_port. " " .dst. " " .dst_port 

which gets me closer, but then outputs each four values encased within the quotations.

 

Can anyone help me out with the desired output?

 

Regards,

Dan

 

 

 

 

 

 

Labels (2)
1 Solution

dwaddle
SplunkTrust
SplunkTrust

The "query" field is special.  Any field named "query" gets its field name stripped going through format.  Try something like this:

|  makeresults 
|  eval src_ip="1.2.3.4", src_port=1234, dest_ip="5.6.7.8", dest_port=5678 
|  eval query=mvappend(src_ip,src_port,dest_ip,dest_port) 
|  fields query
|  format mvsep="AND"

 

The last 3 lines are the relevant part, makeresults is just there to help me mock up some stuff.

View solution in original post

dwaddle
SplunkTrust
SplunkTrust

groovy! please accept as solution?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

The "query" field is special.  Any field named "query" gets its field name stripped going through format.  Try something like this:

|  makeresults 
|  eval src_ip="1.2.3.4", src_port=1234, dest_ip="5.6.7.8", dest_port=5678 
|  eval query=mvappend(src_ip,src_port,dest_ip,dest_port) 
|  fields query
|  format mvsep="AND"

 

The last 3 lines are the relevant part, makeresults is just there to help me mock up some stuff.

SailorManDan
Explorer

@dwaddle 

That's got it!

This is precisely what I was going for. 

Thanks for you help.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...