Splunk Search

splunk subsearch query help

surekhasplunk
Communicator

Hi,

I have a main query which returns below 4 columns:

rule, result, name, department

Now i have to add another query as subsearch where i want to get column address for all the name returned from 1st result. I have fullname column in subsearch index which is same as name from 1st query . how to achieve this . 

Labels (1)
Tags (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @surekhasplunk ,

you have two choices:

  • join: easier to implement but slower,
  • stats: less easy but quicker, I prefer this!

using Join:

your_search_1 
| join name [ search your_search_2 | rename fullname AS name ]
| table rule result name department address

using stats:

your_search_1 OR your_search_2
| rename fullname AS name
| stats values(rule) AS rule values(result) AS result values(department) AS department values(address) AS address By name

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...