Splunk Search
Highlighted

splunk subsearch query help

Communicator

Hi,

I have a main query which returns below 4 columns:

rule, result, name, department

Now i have to add another query as subsearch where i want to get column address for all the name returned from 1st result. I have fullname column in subsearch index which is same as name from 1st query . how to achieve this . 

Labels (1)
Tags (2)
0 Karma
Highlighted

Re: splunk subsearch query help

Legend

Hi @surekhasplunk ,

you have two choices:

  • join: easier to implement but slower,
  • stats: less easy but quicker, I prefer this!

using Join:

your_search_1 
| join name [ search your_search_2 | rename fullname AS name ]
| table rule result name department address

using stats:

your_search_1 OR your_search_2
| rename fullname AS name
| stats values(rule) AS rule values(result) AS result values(department) AS department values(address) AS address By name

Ciao.

Giuseppe

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.