Splunk Search
Highlighted

Subserch - trying to use results from subsearch as an input on the main one.

Explorer

Hi,

I am trying to filter input and output with :
2020-03-31 09:57:11,714 9.5.1455: ERROR syslog156: operation failed for (28, 325). Status codes: 'blablabla'

host="main"   source="main.log"  ERROR syslog*
    | rex "(?=[\(](?<input>\d+)[,])"
    | rex "(?=[, ](?<output>\d+)[\).])"

and later find id with (on log line input is separated from output with 'to')
2020-03-31 09:57:11,020 9.5.1455: INFO syslog890: Should connect/disconnect 28 to 325 for 1.1.8.4.58.1 with operation absolute

host="main"   source="main.log"  INFO syslog*  input "to" output
        | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
        | table _time  id

the complete query looks like that:

  host="main"   source="main.log"  INFO syslog* input "to" output
    | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
    | table _time  id
    [search host="main"   source="main.log"  ERROR syslog*
    | rex "(?=[\(](?<input>\d+)[,])"
    | rex "(?=[, ](?<output>\d+)[\).])"]

2020-03-31 09:57:11,020 9.5.1455: INFO syslog890: Should connect/disconnect 28 to 325 for 1.1.8.4.58.1 with operation absolute
2020-03-31 09:57:11,714 9.5.1455: ERROR syslog156: operation failed for (28, 325). Status codes: 'blablabla'

Tags (1)
0 Karma
Highlighted

Re: Subserch - trying to use results from subsearch as an input on the main one.

SplunkTrust
SplunkTrust

A subsearch should use the fields command to specify which fields are to be passed back to the main search. You may also need format to put those fields into a format that is syntactically correct for the main search.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Subserch - trying to use results from subsearch as an input on the main one.

Explorer

I have added | fields input, output:

  host="main"   source="main.log"  INFO syslog* | fields input, output
     | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
     | rex "(?:disconnect )(?<input_info>\d+)"
     | rex "(?:to )(?<output_info>\d+)"
     | table _time  id
     [search host="main"   source="main.log"  ERROR syslog*
     | rex "(?=[\(](?<input>\d+)[,])"
     | rex "(?=[, ](?<output>\d+)[\).])"]

but still, it doesn't work as I expected.
I would like to use results from first filtering and use it as a base on filtering on the second query. Something like:
if input==inputinfo AND output==outputinfo:
than: table _time id

0 Karma
Highlighted

Re: Subserch - trying to use results from subsearch as an input on the main one.

SplunkTrust
SplunkTrust

The fields and format commands should be in the subsearch (the one within []). Subsearches execute before the main search. The results of the subsearch then become part of the text of the main search.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Subserch - trying to use results from subsearch as an input on the main one.

Explorer

Sorry, I didn't catch, can you please rewrite my query with your fixes

0 Karma
Highlighted

Re: Subserch - trying to use results from subsearch as an input on the main one.

SplunkTrust
SplunkTrust
host="main"   source="main.log"  INFO syslog* 
    [ search host="main"   source="main.log"  ERROR syslog*
      | rex "(?=[\(](?<input>\d+)[,])"
      | rex "(?=[, ](?<output>\d+)[\).])"
      | fields input, output | format ]
    | rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
    | rex "(?:disconnect )(?<input_info>\d+)"
    | rex "(?:to )(?<output_info>\d+)"
    | table _time  id
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Subserch - trying to use results from subsearch as an input on the main one.

Explorer

Still doesn't work.
Maybe I wasn't enough specific about my goal.
From the subsearch I am receiving two ID's (input, output). I would like to use them as values to filter the main search and find id_mrp correlated with both: input and output.

0 Karma
Highlighted

Re: Subserch - trying to use results from subsearch as an input on the main one.

SplunkTrust
SplunkTrust

The subsearch is returning a search string in the form (input=foo OR output=bar). Perhaps that is not the right format for your main search. Let's try another method. This is the general form for one way of combining two searches. The problem is there is no common field between the two searches to use for grouping by the stats command. I'll let you find the common field and update the query.

host="main"   source="main.log"  INFO syslog* 
| rex "(?:\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\.)(?<id>(\d{1,3}))"
| rex "(?:disconnect )(?<input_info>\d+)"
| rex "(?:to )(?<output_info>\d+)"
| append [ search host="main"   source="main.log"  ERROR syslog*
       | rex "(?=[\(](?<input>\d+)[,])"
       | rex "(?=[, ](?<output>\d+)[\).])" ]
| stats values(*) as * by id
| table _time  id
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.