Splunk Search

Why am I getting error "Unknown search command 'sourcetype'" using a subsearch in a where command?

maximus_reborn
Path Finder

I want to do something like the below command but it is giving me an error.

sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count)]

Error:

Unknown search command 'sourcetype'.

Can anyone let me know how to achieve the objective? My aim is to extract the events where passenger_count is greater then the average of that column.

This will happen in real time.

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count) as avg | return $avg]

OR

sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count) as query]

View solution in original post

somesoni2
Revered Legend

Try this

sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count) as avg | return $avg]

OR

sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count) as query]

maximus_reborn
Path Finder

Thanks! It did work.

0 Karma

philippiq
New Member

try to insert 'search' before sourcetype

0 Karma

NOUMSSI
Builder

Hi try this:

sourcetype=SplunkKafka_messaging | spath input=msg_body | where passenger_count > [search sourcetype=SplunkRabbitMQ_messaging | spath input=msg_body | stats avg(passenger_count)]

NOUMSSI
Builder

Dont forget to accept my answer if you were satisfied

0 Karma

maximus_reborn
Path Finder

I am getting 2 errors:
1. Error reading runtime settings: File :/usr/local/splunk/var/run/splunk/dispatch/subsearch_1464015531.154_1464015531.1/runtime.csv does not exist
2. ERROR dispatchRunner - RunDispatch::runDispatchThread threw error: Error in 'where' command: Typechecking failed. The '>' operator received different types

0 Karma
Get Updates on the Splunk Community!

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...