https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448396#M127039 <P>Hi @batuhankutluca<BR /> You don't need to upload a CSV, you can create one on-the-fly like this:</P> <PRE><CODE>sourcetype=xxx | table src_ip dvc|outputlookup ip_to_dvc.csv </CODE></PRE> <P>Then you can do:</P> <PRE><CODE>sourcetype=yyy |lookup ip_to_dvc.csv src_ip as srcip OUTPUT dvc </CODE></PRE> Mon, 18 Mar 2019 14:06:58 GMT nickhills 2019-03-18T14:06:58Z https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448395#M127038 <P>Hello,<BR /> I have a certain search that returns me many fields with values. Next thing I wanna do is get values of "src_ip" field and use them on an other search. I assume I can do that with a subsearch but I it is a bit cost. Other solution I thought was upload the first search's output as csv and get values form lookup but I'm not allowed to upload lookups. Can someone help me about that? Thanks.<BR /> (TLDR - Don't wanna use subsearch, need a solution.)</P> <P>Ex Search: <CODE>sourcetype=xxx | table src_ip -&gt; sourcetype=yyy srcip=$src_ip$</CODE></P> Mon, 18 Mar 2019 13:53:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448395#M127038 batuhankutluca 2019-03-18T13:53:49Z https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448396#M127039 <P>Hi @batuhankutluca<BR /> You don't need to upload a CSV, you can create one on-the-fly like this:</P> <PRE><CODE>sourcetype=xxx | table src_ip dvc|outputlookup ip_to_dvc.csv </CODE></PRE> <P>Then you can do:</P> <PRE><CODE>sourcetype=yyy |lookup ip_to_dvc.csv src_ip as srcip OUTPUT dvc </CODE></PRE> Mon, 18 Mar 2019 14:06:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448396#M127039 nickhills 2019-03-18T14:06:58Z https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448397#M127040 <P>So this doesn't work like subsearch right ? It saves the output of the first search to somewhere and get values for the second search from there ? </P> Mon, 18 Mar 2019 14:09:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448397#M127040 batuhankutluca 2019-03-18T14:09:14Z https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448398#M127041 <P>Correct, you can run this as two different searches.<BR /> This is commonly done to generate a lookup file once a day/hour etc, so you can then use it it subsequent searches.</P> <P>If you wanted to run all the elements at once, there are a number of ways - subsearch as you have mentioned (but ruled out) a 'join' (also performance sucking), or couple of options with a event/stream stats commands, or even with an append. </P> <P>Personally, I like the separate lookup option, but it all depends on your uses case.</P> Mon, 18 Mar 2019 14:15:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448398#M127041 nickhills 2019-03-18T14:15:41Z https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448399#M127042 <P>Oh It fits for my problem then. Yeah as You mentioned that join and subsearch consume much resource. This method is just I wanted. Thanks sir!</P> Mon, 18 Mar 2019 14:24:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-values-from-one-search-to-another-search/m-p/448399#M127042 batuhankutluca 2019-03-18T14:24:10Z