Splunk Cloud Platform

sub search not working

csahoo
Explorer

i want the sub query search result which is a list of tracking id in my main query in clause but none of them are working.
subquery and main working individually but after combining both it's not working, i tried with 3 different option but none of the below are working



1.
index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingID | eval trackingid="\"".mvjoin(trackingid,"\",\"")."\""])

2.
index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) as trackingid | table trackingid | stats values(eval("\"".trackingid."\"")) as search delim="," | nomv search])

3.
index="dockerlogs-silver" "Handle 500 Server error" OR "Handle 4xx error" |where traceID IN ([index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats values(traceID) | format]) |table traceID

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index="dockerlogs-silver" source="*gps-external-processor-prod*" "Handle 500 Server error" OR "Handle 4xx error" | where traceID IN ([search index="dockerlogs-silver" source="*gps-external-processor-prod*" "00012342231515417786" | stats count by traceID
    | eval search="\"".traceID."\""
    | stats values(search) as search
    | eval search = mvjoin(search,",")])
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...