Splunk Search

Why Splunk query returns values when run as separate search, but is not working as a subsearch?

tehale
New Member

My actual search
sourcetype="xyz" Operation=q | eval msg=if(Status == "fail",[search sourcetype="xyz" Operation="p" Status="Fail" |rename message as errorMessage| eval errorMessage=replace(errorMessage,":","")|return $errorMessage ],"successful")|table Status,platform,msg

does not gives values and when ran [search sourcetype="xyz" Operation="p" Status="Fail" |rename message as errorMessage| eval errorMessage=replace(errorMessage,":","")|return $errorMessage ] separately works fine.

I am not sure what is missing.

Tags (2)
0 Karma

jimodonald
Contributor

Your sub search could be timing out before it completes. The default time is 60 seconds, so if your search runs longer than that, it could just be getting killed before it can return results.

References:
http://docs.splunk.com/Documentation/Splunk/6.1.4/Search/Aboutsubsearches

http://docs.splunk.com/Documentation/Splunk/6.1.4/admin/Limitsconf
Look for the [subsearch] section.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...