Implementing Splunk 7, Third Edition - Third Edition

Nested subsearches

Subsearches can also be nested, if needed. With mail server logs, it is sometimes necessary to find all the events related to a particular message. Some fictitious log entries are given, such as:

... in=123 msgid=123456 from=[e-mail] 
... msgid=123456 out=987 subject=Important 
... out=987 to=[e-mail] 

We can see that the first event has the value of from, but there is no longer anything in common with the event that contains the to field. Luckily, there is an interim event that does contain out along with msgid, which we have in the first event.

We can write a query like this to find our events:

[search sourcetype=WebMailIfoDatas out [search sourcetype=WebMailIfoDatas from=[e-mail] | fields msgid] ...