Splunk Search

Using the value of a subsearch in main search

Engager

I am trying to create a search that gets the top value of a search and saves it to a variable:

| eval top=[| eval MB_in=bytes_in/1024/1024 | stats sum(MB_in) by c_ip | rename sum(MB_in) as "Total Megabytes in" | sort -"Total Megabytes in" | head 1 | eval topval=c_ip | return $topval]

I want to then use this value in the main search.

This is currently returning the following error:
Error in 'eval' command: Failed to parse the provided arguments. Usage: eval dest_key = expression.

Tags (2)
0 Karma
1 Solution

Influencer

Value should be returned from a sub-search. Change your query to:

| eval top=[search <subsearch_query>| eval MB_in=bytes_out/1024/1024 | stats sum(MB_in) by c_ip | rename sum(MB_in) as "Total Megabytes Out" | sort -"Total Megabytes Out" | head 1 | eval topval=c_ip | return $topval]

If you are using top to filter base search results, then you can do this.

<base_search> top=[search <subsearch_query>| eval MB_in=bytes_out/1024/1024 | stats sum(MB_in) by c_ip | rename sum(MB_in) as "Total Megabytes Out" | sort -"Total Megabytes Out" | head 1 | eval topval=c_ip | return $topval]

View solution in original post

Influencer

Value should be returned from a sub-search. Change your query to:

| eval top=[search <subsearch_query>| eval MB_in=bytes_out/1024/1024 | stats sum(MB_in) by c_ip | rename sum(MB_in) as "Total Megabytes Out" | sort -"Total Megabytes Out" | head 1 | eval topval=c_ip | return $topval]

If you are using top to filter base search results, then you can do this.

<base_search> top=[search <subsearch_query>| eval MB_in=bytes_out/1024/1024 | stats sum(MB_in) by c_ip | rename sum(MB_in) as "Total Megabytes Out" | sort -"Total Megabytes Out" | head 1 | eval topval=c_ip | return $topval]

View solution in original post

Engager

I have run the first search, I am now being returned with the error "Error in 'eval' command: The number is invalid.", what does this mean?

0 Karma

Influencer

It's type of the value is string then you need to format it:

| eval top=[search | eval MB_in=bytes_out/1024/1024 | stats sum(MB_in) by c_ip | rename sum(MB_in) as "Total Megabytes Out" | sort -"Total Megabytes Out" | head 1 | eval topval=c_ip | return $topval | format ]

you can simplify this query. Return command returns first row value by default.

| eval top=[search <subsearch_query> | stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return $c_ip | format ]
0 Karma

Engager

Amazing, so I now have a field called top in my main search - this is an IP. I am now trying to use this top value to filter the c_ip field. I have done this by searching for |search c_ip=top. This in not returning any results. am i filtering this in the correct way?

0 Karma

Influencer

Then you don't need to format, you can filter main search like this.

| search c_ip=[search <subsearch_query> | stats sum(bytes_out) as "Total Bytes Out" by c_ip | sort -"Total Bytes Out" | return $c_ip ]
0 Karma

Engager

You are the splunk god, thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!