Splunk Search

stuck on a subsearch

dbcase
Motivator

Hi,

I have this query, what I'm trying to do is pull the mac address out of events with a 405 error dedup them then put them in a table. Then taking that table search the same index and match on mac address and pull out the external account id and finally put the mac address and external account id in a table. I can break apart the query and it seems to work, just not working when I put it together. Thoughts?

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|table extref|where len(extref)<10|table mac extref
Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*"|rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"  | search [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac

View solution in original post

0 Karma

somesoni2
Revered Legend

Try this

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*"|rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"  | search [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac
0 Karma

dbcase
Motivator

Can you convert to answer?

0 Karma

dbcase
Motivator

ahhhh search then [search

Thanks Somesoni2!!!

0 Karma

dbcase
Motivator

failed attempt #2

index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" [search index=blah source="/var/nfs/SAT_SplunkLogs/wscvr/blah_portal*" 405|rex "deviceregistry.(?<mac>[a-fA-F0-9\.:-]{12,17})"|dedup mac|table mac] |rex ".macAddress.:.(?<mac>[a-fA-F0-9\.:-]{12,17})"|rex "externalAccountId...(?<extref>\d+)"|where len(extref)<10| stats list(extref) AS "External Reference", values(mac) AS "Mac Address" BY mac
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...