Splunk Search

how to pass the output of one query as search key to a subsearch?

bkumarm
Contributor

I have raw events that look as below:

2018:08:22:22:39:51.731 myhostname 3:INFO MY_IDENTIFIER_TEST 548026790130303164 454
2018:08:22:22:39:51.731 myhostname 3:INFO MY_STR_METHOD_ACTION.COMPONENT TEST 548026790130303164
2018:08:22:22:39:51.752 myhostname 1:ERR1 MY_SERVICE_TYPE STRTST 548026790130303164 ERRMSG : Main problem: Sub problem message

=====================================
I want to create a table that have equal "548026790130303164" values in 2dn and and 3rd row.
need help in getting the right search query.

I want the three column table output like below:

548026790130303164 "MY_STR_METHOD_ACTION.COMPONENT" "ERRMSG : Main problem: Sub problem message"

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@bkumarm

you can use transaction command to co-relate events.
http://docs.splunk.com/Documentation/Splunk/7.1.3/SearchReference/Transaction

Can you please tell me in which field you are getting value 548026790130303164? So I can help you to design search.

0 Karma

bkumarm
Contributor

I need a list of refids that have MY_STR_METHOD_ACTION and ERRMSG : Main problem: Sub problem message

Example:
2018:08:22:22:39:51.731 myhostname 3:INFO MY_IDENTIFIER1_TEST 548026790130303164 454
2018:08:22:22:39:51.731 myhostname 3:INFO MY_STR_METHOD_ACTION1.COMPONENT1 TEST 548026790130303164
2018:08:22:22:39:51.752 myhostname 1:ERR1 MY_SERVICE_TYPE STRTST 548026790130303164 ERRMSG : Main problem1: Sub problem message11

the output should be
548026790130303164 MY_STR_METHOD_ACTION1.COMPONENT1 ERRMSG : Main problem1: Sub problem message11

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...