Web14 Apr 2024 · It appears as though you are trying to use "[3]" as an array index into the results of the split function. That's not how to do it, both because of the subsearch feature … Web15 May 2024 · Subsearches are enclosed in square brackets [] and are always executed first. The means the results of a subsearch get passed to the main search, not the other way …

pass variable and value to subsearch - Splunk Community

WebI tried your suggestion (moving the regex to after the subsearch) previously and the search returned with only the base search without the subsearch results fed into the base. So what I would see is all of the downloaded files of different users, but it should only be for that small subset of hosts that were seen spawning a browser from outlook. WebI'm attempting to find file downloads within a 2 minute timespan following a browser being spawned from outlook (my subsearch). Everything works find (the search andsubsearch) until I add the regex command limiting the filepath to the downloads folder. I'm getting the error " Error in 'SearchOperator:regex': Usage: regex (= !=) ." eco fresh 300

About subsearches - Splunk Documentation

WebBasically it sets the earliest and latest SPL time modifiers in subsearch so only events in the expected time period are returned. You may need to make adjustments if the logic is not quite what you want but hopefully you are able to make any adjustments yourself by playing around with the subsearch query in another window. Web10 Apr 2011 · Splunk Employee 04-11-2011 03:29 PM The output of a subsearch is a valid search expression that will match an event when it matches all the fields of any of the … Web10 Aug 2024 · So how do we do a subsearch? In your Splunk search, you just have to add [ search [subsearch content] ] example [ search transaction_id="1" ] So in our example, the … ecofresh 556625 light bulb