searching subset of original search

[ChrisCLewis]

Good afternoon,

I am trying to find a way to carry out a search to find a subset of data and to then carry out more than one search on these subsets, without saving any of the data (i.e. not allowed to use lookup)

Each time stats are created for the subset I will need to then do another search on the subset to get a sub-sub set of data to generate stats for.

I can get it working by using append and running the original search, including additional criteria but this makes the searches very slow and prone to timing out.

The stats are not the same for each sub-search.

Appendcols / appendpipe / join do not seem to be working when just adding the extra search requirements.

I'd like to have 2 or 3 dashboards which have all the sub data calculated rather than having to do 20+ individual searches (scheduled reports are not an option either) - Or am I asking too much of splunk 😉

Many thanks for your time

[somesoni2]

Since you plan to create a dashboard, have you looked at Post Process searches in Splunk?

http://docs.splunk.com/Documentation/Splunk/7.2.1/Viz/Savedsearches#Post-process_searches_2

This concept provides you a way to run one base search and power other "subsearches" from result of base search. So you would have to find a way to merge your existing searches, preferably till stats, which will allow you to add filters at post-process subsearches.

It would help if you can share some sample searches that you want to power off from single search (mask anything that's sensitive).

[ktugwell_splunk]

Have you thought about chaining searches together using a base search in a dashboard, outputting the sid of that search to a token, then using the | loadjob <sid> command to load the results, then you can perform more stats?

[ChrisCLewis]

Good afternoon,

Many thanks for the speedy reply. I've not seen this before - I shall go and do some looking into as it looks good..