Splunk Search

Using subsearch result as a "contains" filter

denissotoacc
Path Finder

I have a search that I need to filter by a field, using another search. Normally, I would do this:

main_search where [subsearch | table field_filtered | format ]


It works like this:

main_search
for result in subsearch:
    field_filtered=result


In my case, I need to use each result of subsearch as filter BUT as "contains" and not "equal to". I tried something like this but is not working:

main_search | where in (field_filtered,[subsearch])

How can I success in this?

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Here is a runanywhere example which demonstrates a technique you might be able to adapt.

index=_internal sourcetype=splunkd_ui_access
| where match(uri_path,
    [search index=_internal sourcetype=splunkd_ui_access
| stats count by uri_path
| head 1
| eval path=split(uri_path,"/")
| eval query=trim(mvjoin(mvindex(path,2,3),"|"),"|")
| table query
| format])
| stats count by uri_path

Essentially, what it does is use the match function on the field you want to filter on, with a subsearch to deliver a pipe-delimited string which act as OR's in the match function.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...