#SPLUNK SUBSEARCH BASED ON RESULTS HOW TO#

This search uses the count () function to give the VIP shopper the total number of purchases. An alias for the function separct count() is dc(). This search uses multiple statistical functions with the command Stats. Sourcetype=access_* status=200 action=purchase clientip=87.194.216.51 | stats count, distinct_count(productId), values(productId) by clientip Use the stats command to count this VIP Customer's purchases.

Then we have to carry out another search to decide how many different items the VIP shopper has ordered.

These are the default fields in which the top Command returns. The search also returns a percent and a count.

In Splunk, this search returns one clienttip value, 87.194.216.51, to identify the VIP shopper. The clientip argument specifies the field to return. Here, the limit=1 argument specifies to return 1 value. Sourcetype=access_* status=200 action=purchase | top limit=1 clientip We are using this search to find the shopper who has the most accessed online shop.We will use the top Command to return the most persistent shopper. We want to find the single most frequent shopper and what that shopper has purchased on the online store Buttercup Games. Example 2 shows how a sub search might find the most frequent shopper.

#SPLUNK SUBSEARCH BASED ON RESULTS HOW TO#

Example 1 illustrates how to locate the shopper most often without sub searching. The following examples show why it is useful to do a sub search. Let's find the single most common shopper on the online store Buttercup Games, and what that shopper has bought. In the main search, sub searches are enclosed in square brackets and assessed first. The subsearch result will then be used as an argument for the primary, or outer, search.

Use a subsearchĪ subsearch is a search used to narrow down the range of events we are looking on.

We will learn about how to use the se searching with the help of different examples and also how we can improve our sub searching and how easily we can do sub searching. The sub searching is a very important part of the Splunk searching to search the data effectively in our data pool. But you shouldn't need that for this.In this section, we are going to learn about the Sub-searching in the Splunk platform. Subsearches get tricky, there's all sorts of formatting and reformatting you can do to the output to make it behave slightly differently. That should be the actual search - after subsearches were calculated - that Splunk ran.Ī good resource is to search Splunk Docs for subsearches - the first few hits on this search are all really good. 'search this page with your browser') and search for 'Expanded filtering search' In the 'Search job inspector' near the top click 'search.log' There's a trick to finding the ACTUAL search. One great tip is that you can inspect the job and find out what the search looks like. So now, this |inputlookup test_results | search If you run that on its own, it should return a field 'build' with a value of 'BuildValue'. So let's rephrase the subsearch just a hair to make sure we have the results in the right format: |inputlookup test|stats first(build) AS build | fields build The easiest way to do this would be to trim down your stats results to JUST the one field you want, right? Then ,by default, the way the subsearch would return it would be as key-value pairs. What you WANT is for the subsearch to return a correctly formatted piece of a search for you to use. That should work (assuming the lookup has the field build). Though I'm not sure why you are using where - the where in Splunk is a trickier and easier-to-get-wrong version of search so let's try that instead - |inputlookup test_results | search build=BuildValue. If you then search |inputlookup test_results |where build=BuildValue it would work. This: |inputlookup test|stats first(build) returns some value for build (I'm lazy and I'll pretend it returns the value 'BuildValue'). My guess is that if you did the two simple things - as you hint at that you do - these both work. So let's look at your example, tearing it down into a couple of pieces: |inputlookup test_results |where build = Beinga subsearch, they run first and their results get inserted into the main search exactly where they are. The way a subsearch works is it returns results just like a regular search.

Splunk subsearch based on results