Splunk Search

Why can't I see preliminary search results when using associate command?

TAE
Engager

In my SPL I use the associate command.  However, I've noticed that when I use the command, any previous preliminary search results before the associate command are not available for use after the command. 

Why is that and how can I save earlier search results until after the associate command for use?

Labels (1)
Tags (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The only method I can think of is to save the results prior to the associate command in a lookup table and then read them in later.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

TAE
Engager

Yep.  I tried that with in inputcsv and outputcsv.  Something was wrong not sure what, still investigating.  Trying to use tokens on the dashboard currently to hold the intermediate results, that may do what I need.

Still working that potential soln.

0 Karma

TAE
Engager

Yes, I believe so as well.  Can you think of a way to get at my preliminary search results given that I may have a transformative command in the mix?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The only method I can think of is to save the results prior to the associate command in a lookup table and then read them in later.

---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Although not documented as such, I would consider associate to be a transforming command because of the behavior you describe.  The command produces a specific set of output fields for each field processed.  All other fields are discarded.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...