Splunk Search

Parse a value and then use that as new query to search?

zakirhere
New Member

Hi,

I have an unusual scenario for the data I am working with and would like to see if it's even possible to extract data this way. In brief, I parsed a value from my initial search query to a variable using rex and now I want to use only that value as new query instead of sub-query.

Workflow:

  1. Find all successful test runs for a suite (this is a long query)
  2. Find reporting_url via event on each run 
  3. Parse uuid from reporting_url (I used rex on raw data and saved it on variable like res_uuid)
  4. Search only that uuid as that has multiple test_id records showing count of Pass/Fail counts.
  5. (Eventually create a graph for the same)

Trying to make a simple example:

First query -> Gives test suite level record. Parse to get UUID value

Second query -> Independent query using that UUID and then use that for making graph. Please note that 2nd query results not linked with 1st query and sub-search will only give one record. 

 

 

(Apologies if it's a very common workflow but I was not able to search it easily)

 

Labels (4)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @zakirhere,

You can append the new UUID value to a lookup, your second search use that lookup for the graph.

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

zakirhere
New Member

Lookup on that result only shows results from the parent level (meaning same result). I checked in other groups and looks like I have to use some external programming language to pass these variable values and start a new query.

0 Karma
Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...