Now we want to see the ip-address of that user who purchased most products from our site with all purchased product id. Here in the “sample_set” index and “access_combined_wcookie” sourcetype, we have data related to online merchant site “which gives us information related to product purchasing, add to cart, view etc actions. | stats count(productId) as Product_Count values(productId) as Product_ID by ip Use Case: index='sample_set' sourcetype=access_combined_wcookie action=purchase status=200 As one can see it brings the result like this, where the result of one event is bounded in a bracket and every event is separated by “OR”. it will bring the “|head 3” value of our result. we want to see the who viewed our product most recently), Then we have used “return” command to return the ip and JSESSIONID of those user and also we have used count=3, i.e. Here we took data from “sample_set” index and “access_combined_wcookie” sourcetype, then “action=view” and “status=200” (i.e. we return the value of ‘ip’ field only in the search field.Įxample 5: index='sample_set' sourcetype=access_combined_wcookie action=view status=200 | return 3 ip JSESSIONID Here also as you can see everything’s the same as earlier but the only change is with the “return” command. You can alter as per the requirement of your primary search.Įxample 4: index='sample_set' sourcetype=access_combined_wcookie action=view status=200 | top ip | return $ip

we return the value of ‘ip’ field in an alias named as “client_ip”. You can also know about : Usage of Splunk commands : ADDTOTALSĮxample 3: index='sample_set' sourcetype=access_combined_wcookie action=purchase status=200 | top ip | return client_ip=ipĪs you can see everything is the same as earlier but the only change is with “return” command. Now this time we are using |return 10, to get 10 ip values in the search field. we want to see who viewed our product most), and then using top command we bring the most viewed ip’s and last we used return command to return our result. Then we have added two filters “action=view” and “status=200” (i.e. Here we took data from the “sample_set” index and “access_combined_wcookie” sourcetype,which consist of data related to an online merchant site. By using the return command it only brings one column, which consists of the “ip” value.Įxample 2: index='sample_set' sourcetype=access_combined_wcookie action=view status=200 |top ip |return 10 ip As we can see that it brings the result in the form of a field value pair (i.e.

By default return command use “|head 1” to return the 1st value.

$ – Name of the fields to return with “$” sign, you can mention more than one field name separated by spaces.Īt first we will see how the “return” command returns the result, then we will use that query as a sub search within a primary search and will try to understand the function.Įxample 1: index='sample_set' sourcetype=access_combined_wcookie action=view status=200 |top ip |return ip – Name of the fields to return, you can mention more than one field name separated by spaces. = – Mention field alias and field name of values to be returned, you can mention more than one = pair separated by spaces. – Number of results you want to return (default is 1) The return command automatically limits the number of incoming events with the “head” command and the resulting fields with the “fields” command. Generally it’s a procedure of adding condition dynamically to your main search. A sub search looks for a single piece of information that is then added as a criteria, to the main search. “Sub search” in Splunk – A sub search is a search within a primary search. “Return” command basically returns the result from the sub search to your main search.

Splunk subsearch based on results