Splunk Dev

Run saved search multiple times in same query?

stwong
Communicator

Hi,

We used to append saved search results as following without problem:

| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | append [|savedsearch Test_VPN_log_stats  ]

However, when same saved search is used, e.g.

| savedsearch Test_VPN_log_stats| append [|savedsearch Test_VPN_log_stats  ]

We'll get error like this:

Error in 'SearchParser': Found circular dependency when expanding savedsearch=Test_VPN_log_stats

Would like to know if it's possible to:

  1. append output of same saved query multiple times?
  2. pass fields from the first saved search to the appending ones, e.g. IPAddr and UserName are 2 of the resulting field from saved search Test_RADIUS_report:

    | savedsearch Test_RADIUS_report ipaddr="" username="Amuro" | append [|savedsearch Test_RADIUS_report ipaddr=$IPAddr username="" ] |append [| savedsearch Test_RADIUS_report ipaddr="*" username=$UserName ] | more append ....
    Sorry that I've old school thinking and and hope savedsearch can be used as function call that can be called recursively.
    Would anyone please help?

Thanks a lot.
Regards

Tags (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

You might be able to use selfjoin (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Selfjoin) but better yet, try multireport (no docs on this yet), like this:

| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro"
| multireport
    [| stats count BY host]
    [| stats count BY sourcetype]
    [| stats count BY server]

Or multisearch, like this:

| multisearch
    [| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=1] 
    [| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=2] 
    [| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=3]
| stats count BY set

View solution in original post

0 Karma

woodcock
Esteemed Legend

You might be able to use selfjoin (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Selfjoin) but better yet, try multireport (no docs on this yet), like this:

| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro"
| multireport
    [| stats count BY host]
    [| stats count BY sourcetype]
    [| stats count BY server]

Or multisearch, like this:

| multisearch
    [| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=1] 
    [| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=2] 
    [| savedsearch Test_RADIUS_SavedSearch ipaddr="*" bool="" username="Amuro" | eval set=3]
| stats count BY set
0 Karma

stwong
Communicator

That's helpful. Thanks a lot.

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...