Splunk Search

splunk query with sub search not returning the desired results

vivek991985
New Member

Query is:
index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".]*Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "" + ID + "*" | return $ID ]

It returns the results for ID='2138536' (2 events as expected) but also returns additional events (5 more message events) for other IDs.

Please advise if there is anything wrong with the query.

0 Karma

vinaypradhan
Explorer

what is the logic of the result that you are expecting? are you expecting to see only the common ones between File1.log and File2,log ? you can try using set intersect here, which should get you only the common entries.
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Set

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Run the subsearch by itself to see what results it produces. Those results will be what the main search looks for so make sure they are correct before continuing.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

vivek991985
New Member

Corrected:

index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".]Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "" + ID + "" | return $ID ]

0 Karma