Splunk Search

splunk query with sub search not returning the desired results

vivek991985
New Member

Query is:
index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".]*Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "" + ID + "*" | return $ID ]

It returns the results for ID='2138536' (2 events as expected) but also returns additional events (5 more message events) for other IDs.

Please advise if there is anything wrong with the query.

0 Karma

vinaypradhan
Explorer

what is the logic of the result that you are expecting? are you expecting to see only the common ones between File1.log and File2,log ? you can try using set intersect here, which should get you only the common entries.
https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchReference/Set

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Run the subsearch by itself to see what results it produces. Those results will be what the main search looks for so make sure they are correct before continuing.

---
If this reply helps you, Karma would be appreciated.
0 Karma

vivek991985
New Member

Corrected:

index=xyz source ="File1.log" [ search index=xyz source="File2.log" search_input | rex ".]Rpc id :(?[0-9][0-9][0-9][0-9][0-9][0-9])" | eval ID = "" + ID + "" | return $ID ]

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...