Splunk Search

EVAL with Sub search

Reddy_dash
Engager

Hi Friends,

If I execute below highlighted query I am getting the result where when I supply the result as search it is not returning any result

index=* env=X1 SourceName=*api* [search index=* env=X1 SourceName=*api* "Transaction" | eval "TraceID"=substr(Message,85,36) | table "TraceID"]

Please help on this.

Thanks

Labels (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

If you run the subsearch with | format appended to it then you'll see what is added on to the main search.  That has to make sense with your data to get resuits.  I suspect your subsearch is producing a result like this:

(TraceID="foo" OR TraceID="bar" OR TraceID="baz")

If the events do not contain a field called "TraceID" then no results will be found.

Try this subsearch, instead.

search index=* env=X1 SourceName=*api* "Transaction" | eval "TraceID"=substr(Message,85,36) | return 1000 $TraceID
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

If you run the subsearch with | format appended to it then you'll see what is added on to the main search.  That has to make sense with your data to get resuits.  I suspect your subsearch is producing a result like this:

(TraceID="foo" OR TraceID="bar" OR TraceID="baz")

If the events do not contain a field called "TraceID" then no results will be found.

Try this subsearch, instead.

search index=* env=X1 SourceName=*api* "Transaction" | eval "TraceID"=substr(Message,85,36) | return 1000 $TraceID
---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...