Splunk Search

how can i pass the field values from one search to my subsearch or to another search

Nadhiya123
Explorer

index=xx sourcetype=yy |eval ..|table aa
[| search index=xx1 sourcetype=yy1 yy=aa values |table yy zz ff ] in a single search ..

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi Nadhiya123,
if you want to use a field of the soubsearch to filter the main search you have to run something like this:

index=xx1 sourcetype=yy1  [ search index=xx sourcetype=yy |eval .. | rename aa AS yy | table yy ]
|table yy zz ff

you have only to put attention that fieldname is the same both in main and sub search (use rename command in subsearch) and remember that subsearch has 50,000 events limit.

If instead you want to use a field to join two searches, you can run something like this:

index=xx sourcetype=yy 
| eval ..
| join aa [| search index=xx1 sourcetype=yy1 ]
| table aa yy zz ff 

Bye.
Giuseppe

0 Karma

Nadhiya123
Explorer

how can I include maxout in my subsearch since its truncating the results

0 Karma

gcusello
SplunkTrust
SplunkTrust

To modify the 50,000 limit for subsearches results you have to modify limits.conf file, but with attention!
see http://docs.splunk.com/Documentation/Splunk/latest/Admin/Limitsconf?ac=partner_smt
bye.
Giuseppe

0 Karma

Nadhiya123
Explorer

Is there an option to include in the SPL query

0 Karma

gcusello
SplunkTrust
SplunkTrust

No! only in limits.conf configuration file.
Bye.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...