Use Subsearch to insert commands

[duesser]

Hello,

I would like to use a subsearch to literally paste a command into the SPL e.g.:

| makeresults
[| makeresults
| eval test="|eval t1 = \"hello\""
| return $test]

and for it to be equivalent to

| makeresults
| eval t1 = "hello"

Is this possible?

[PickleRick]

Do a quick test:

[ | makeresults | eval search="| makeresults" ]

If you look into the job log you'll see that while the internal search will get expanded to

Expanded index search = ([ | makeresults | eval search="| makeresults" ])

After the subsearch is evaluated and the result is returned to the outer search it will be treated as a string, with the pipe control character escaped

Expanded index search = (\| makeresults)

Which means that you will be searching for literal pipe character and "makeresults" word.

[duesser]

Yes I have seen this exactly. But is it possible to work around this in any way?

[PickleRick · Accepted solution]

I should expect not.

[duesser]

I know that I can do

index=abc
         [
            | makeresults
            | addinfo
            | eval filter_t="earliest=".(info_min_time-60)." latest=".info_max_time
            | return filter_t
         ]

which literally becomes 

index=abc earliest=1698301592.0 latest=1698301792.0

 and I would like to use this behavior to dynamically define a command

[gcusello]

Hi @duesser,

pleae try this:

index=abc
         [
            | makeresults
            | addinfo
            | eval earliest=relative_time(info_min_time,"-60s"), latest=info_max_time
            | fields earliest latest
         ]

Ciao.

Giuseppe

[duesser]

I am sorry for the confusion, I updated the original question.

The idea is to dynamically create strings of eval commands in a sub search (depending on a lookup e.g.) and then applying these to the base search by literally putting the into the search command. I hope I could clarify this now.

[gcusello]

Hi @duesser ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the contributors 😉

[gcusello]

HI @duesser,

when you use a subsearch, you run a search on the main search using the output (exactly the fields you have in return or in fields).

What's your requirement?

Ciao.

Giuseppe