Splunk Search

Parse a value and then use that as new query to search?

zakirhere
New Member

Hi,

I have an unusual scenario for the data I am working with and would like to see if it's even possible to extract data this way. In brief, I parsed a value from my initial search query to a variable using rex and now I want to use only that value as new query instead of sub-query.

Workflow:

  1. Find all successful test runs for a suite (this is a long query)
  2. Find reporting_url via event on each run 
  3. Parse uuid from reporting_url (I used rex on raw data and saved it on variable like res_uuid)
  4. Search only that uuid as that has multiple test_id records showing count of Pass/Fail counts.
  5. (Eventually create a graph for the same)

Trying to make a simple example:

First query -> Gives test suite level record. Parse to get UUID value

Second query -> Independent query using that UUID and then use that for making graph. Please note that 2nd query results not linked with 1st query and sub-search will only give one record. 

 

 

(Apologies if it's a very common workflow but I was not able to search it easily)

 

Labels (4)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @zakirhere,

You can append the new UUID value to a lookup, your second search use that lookup for the graph.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

zakirhere
New Member

Lookup on that result only shows results from the parent level (meaning same result). I checked in other groups and looks like I have to use some external programming language to pass these variable values and start a new query.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...