Splunk Search

subsearch returning an empty set causes unexpected results

timpgray
Path Finder

I am using a subsearch to qualify an outer search. Simplified, it looks something like this:

Index =AAAA [index=AAAA “some condition” | dedup BBBB | return 100 BBBB]

The intent is to use the returned values of the field ‘BBBB’ to qualify the outer search and this works as expected. However, there is a corner case where this fails badly. When the value ‘some condition’ does not show up in the searched data, the subsearch returns an empty set and the outer search is then left wide open producing some unexpected results.

Does anyone have any suggestion how I might construct the subsearch to return NOT() in the scenario that the inner condition is not met?

Tags (3)
1 Solution

Ayn
Legend

This is what the subsearch already normally does when no results are found. Using return at the end causes a different behaviour though. Rewriting the query not to use return should fix it.

index=AAAA [search index=AAAA "some condition" | dedup BBBB | head 100 | fields BBBB]

View solution in original post

Ayn
Legend

This is what the subsearch already normally does when no results are found. Using return at the end causes a different behaviour though. Rewriting the query not to use return should fix it.

index=AAAA [search index=AAAA "some condition" | dedup BBBB | head 100 | fields BBBB]

Ayn
Legend

No problem - if you want to see for yourself exactly what the subsearch will return, just run the search by itself and add "| format" at the end.

0 Karma

timpgray
Path Finder

thanks - that helps a lot.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...