Splunk Search

search all another field from a search result of grouping by another field in another search

krishna81m
Engager


We have multiple TraceIDs that have same payload and this payload is part many logs for a given TraceID. Here foo1 is a common payload for multiple TraceIDs 1, 3, 4. Is it possible to search for all unique traceIDs 1, 2 only based on the payload, then get all of the logs for these traces?

Input:
TraceID Type             Name        Payload
1               HEADER     first            foo1
2               HEADER     first            foo2
3               HEADER     first            foo1
4               HEADER     first            foo1

Output:
TraceID Type             Name        Payload
1               HEADER     first            foo1
2               HEADER     first            foo2

You can get unique traceIds grouped by Payload using
stats max(traceId) as maxTraceId, min(traceId) as minTraceId by payload

Now, how do we feed the maxTraceId into another search? We need all of the logs for these TraceID 1, 2 only. These requests did not work.

some_search [ search some_search | stats max(traceId) as maxTraceId by payload | fields maxTraceId ]
some_search [ search some_search | streamstats max(traceId) as maxTraceId bypayload | fields maxTraceId ]
some_search | where traceId IN [ search some_search | stats max(traceId) as maxtraceId by paload | fields maxtraceId ]


TraceID Type             Name        Payload
1               HEADER     first            foo1
1               BODY           second     bar1
1               FOOTER      third           baz1
2               HEADER     first            foo2
2               BODY           second     bar2
2               FOOTER      third           baz2

Labels (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

It's not clear what you want to achieve. Just remember that if you return values from a subsearch they create additional conditions as if you literarily supplied all of those conditions at once.

So if your subsearch returns two TraceID fields, your main search after subsearch expansion will have form of

<<rest of the search>> (TraceID=val1 OR TraceID=val2)

If you want to run separate search for each of the TraceID values you might want to look into the map command.

0 Karma

krishna81m
Engager

:)., my example has as much details as I can give and why my subsearch examples did not work.

Its a simple search trying to find all unique values of fieldA and feed them into another search to give all logs containing these fieldA unique value.

Let me give subsearch using map a shot.

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...