Use time and field from subsearch as search criteria in main search

[nkavouris]

I have a subsearch

[search index="june_analytics_logs_prod" (message=* new_state: Diagnostic, old_state: Home*)|
spath serial output=serial_number|
spath message output=message|
spath model_number output=model|
eval keystone_time=strftime(_time,"%Y-%m-%d %H:%M:%S.%Q")|
eval before=keystone_time-10|
eval after=_time+10|
eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S.%Q")|
table keystone_time, serial_number, message, model, after|

I would like to take the after and serial fields, use these fields to search construct a main  search like

search index="june_analytics_logs_prod" serial=$serial_number$ message=*glow_v:* earliest=$keystone_time$ latest=$after$|

Each event yielded by the subsearch yields a time when the event occured

I want to find events, matching the same serial, with messages containing "glow_v" within 10 seconds after each of the subsearch events

[gcusello]

Hi @nkavouris ,

you can use a subsearch to filter results in the main search passing the fields with the same name and putting attention to pass only the fields to use for filtering, in your case:

• keystone_time,
• serial_number,
• message,
• after

but not model that isn't used in the main search.

The problem is the message field because you need to use it as a part of the search, ib this case you have to rename it in "query":

search index="june_analytics_logs_prod" 
[[search index="june_analytics_logs_prod" (message=* new_state: Diagnostic, old_state: Home*)
| spath serial output=serial_number
| spath message output=message
| spath model_number output=model
| eval 
     keystone_time=strftime(_time,"%Y-%m-%d %H:%M:%S.%Q"),
     before=keystone_time-10,
     after=_time+10,
     eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S.%Q")
| rename message AS query
| fields keystone_time serial_number query after ]

the renaming of message AS query permits to search in full text search mode.

I didn't use it with other fields, only by itself, but it should run.

Ciao.

Giuseppe

[PickleRick]

You're asking for trouble. While you might try to use subsearch to return a set of criteria for the main search it is a very unreliable way to do it and you're bound to have unexplained wrong search results especially if searching over larger datasets due to subsearch limitations.

Additionallly there are several problems with your searches.

Both are highly inefficient due to wildcard use at the beginning of search term.

You can't do arithmetics on a string-rendered timestamp.

This is not a right format for earliest/latest (to be safe it's best to just use epoch timestamps for those parameters if calculating them from subsearch).

Your first search contains several separate search terms instead of - as I presume - a single string.

After this overly long introduction - It's probably best done completely differently - for example with streamstats marking subsequent events.