Splunk Search

Difference between outputs of same query as search and subsearch

ebarnhill
Engager

Noob here. Can anyone tell me why the following search:

search sourcetype=srt  | table serialNumber

will give me a one-column table of serial numbers as expected, while the same query in subsearch brackets

[search sourcetype=srt  | table serialNumber]

does not return the same table that I expect, but rather returns the full record?

Labels (1)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @ebarnhill,

Subsearch outputs are formatted as search string. In your case the result is 

serialNumber=serialNumber1 OR serialNumber=serialNumber2 OR ...

You can test the subsearch output by adding format command end of the normal search

search sourcetype=srt  | table serialNumber | format
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @ebarnhill,

Subsearch outputs are formatted as search string. In your case the result is 

serialNumber=serialNumber1 OR serialNumber=serialNumber2 OR ...

You can test the subsearch output by adding format command end of the normal search

search sourcetype=srt  | table serialNumber | format
If this reply helps you an upvote and "Accept as Solution" is appreciated.
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...