topic Re: Extract user list and use in next query in All Apps and Add-ons

Extract user list and use in next query

MattQ — Wed, 05 Feb 2014 19:11:52 GMT

I have a search that returns a number of UserNames. I would like to extract just the usernames [field:UserName] from the search results and then do a follow on search for all the items that have those usernames in them.

Search and return 'ListOfUsers'
Use 'ListOfUsers' to Search index=* (or separate broad search) to return ALL activity from 'ListOfUsers'

Re: Extract user list and use in next query

David — Wed, 05 Feb 2014 19:14:35 GMT

This is a great use case for a subsearch. You would have your entire search be:

[search <search criteria for the list of users> | fields UserName] <search for activities>

The subsearch will output a series usernames that are then criteria for the broader search. Make sure you start your subsearch with "search."

Re: Extract user list and use in next query

MattQ — Wed, 05 Feb 2014 19:18:07 GMT

That works to input a field into a more limited search. Is there a way to port those results into a wider search. Like back into index=* UserNameList

Re: Extract user list and use in next query

alacercogitatus — Wed, 05 Feb 2014 19:32:30 GMT

Sure.

index=* [ search your_search_for_users | table UserName ] | do_other_things

But.... subsearches are inefficient, since they consume 2 cpus per execution. A nicer way would be to keep a lookup of users, and then use the lookup in the search.

The Saved Search that runs every so often:

index=whatever find_your_users | table UserName | outputlookup interesting_users.csv

Then use it in a "sub-searchy" kind of way.

index=* other_criteria [ | inputlookup interesting_users.csv | table UserName ]