Splunk Search
Highlighted

subsearches do not work after upgrade.

Splunk Employee
Splunk Employee

We were on 3.4.6 and I think subsearches worked fine. We upgraded to 4.0.10 and they broke. So I upgraded to 4.1.1, and they're still broken. It might be something in limits.conf, but we're pretty close to default there.

eventtype=abc mailto=xyz

returns 4 results.

eventtype=abc mailto=xyz | fields + mid|format

returns those same results as ((mid="1") OR (mid="2") OR (mid="3") OR (mid="4"))

eventtype=abc [search eventtype=abc mailto=xyz | fields + mid]

or anything with a subsearch returns no results. The Cisco E-Mail Security Form Search from the cisco_esa_addon app does a search similar to this and returns nothing.

any ideas?

TIA, .gz

Tags (3)
Highlighted

Re: subsearches do not work after upgrade.

Splunk Employee
Splunk Employee

Can you try:

eventtype=abc [search eventtype=abc mailto=xyz | fields + mid | fields - _* ]

and see if that works?

0 Karma
Highlighted

Re: subsearches do not work after upgrade.

SplunkTrust
SplunkTrust

I recommend also running the search and then doing

Actions > Inspect Search

you'll see a page with lots of strange data on it. Scroll down to find the 'remoteSearch' entry. The search you'll see there will have some very strange looking characteristics. You'll see some weird 'litsearch' commands and it'll look a little weird. However it will also have expanded all the eventtypes, and it will also have the basic terms that came out of your subsearch.

Take a look at that and that may help.

Highlighted

Re: subsearches do not work after upgrade.

Splunk Employee
Splunk Employee

oh, if it's not too much trouble, can you tell us how mid is extracted? more specifically, are the values of mid delimited on each side by non-word character? e.g., if mid is 2, is it extracted from xxx, 2, yyy or is is more like xxx, n2, yyy or even xxx, n2m, yyy?

0 Karma
Highlighted

Re: subsearches do not work after upgrade.

Splunk Employee
Splunk Employee

trying to be more clear, is the value of mid a word by itself in the raw text, or is it a part of a word in the raw text?

0 Karma