topic Using values from search into subsearch in Splunk Search

Using values from search into subsearch

hoytn — Wed, 26 Jun 2019 09:09:03 GMT

Hello,

In a timerange (lets say 4 hours) I am trying to find password resets and after that, for the same user, all the logins.
Is it possible to this in a search? I was looking at append but I don't see how I can use the field user and _time from first search (finding the password resets) to filter the second search (finding the logins)

Thank you.

Re: Using values from search into subsearch

Richfez — Sun, 30 Jun 2019 02:34:26 GMT

I recommend taking as much time as is necessary to fully understand the fine tutorial in the docs. Of course that requires having set up and gone through the tutorial...

Another good resource is also in the docs, the page about subsearches.

When you have really tried to understand those two things, try your search/subsearch again and see where that gets you.

Then maybe this helps - the subsearch RUNS FIRST. Right? It runs, and its results get shoved into the main search as search criteria.

mybasesearch [some search that returns a name of either "Billy" or "Sally"]
Ends up being
mybasesearch (name=Billy OR name=Sally)
E.g the subsearch JUST returns its results as search items.

(More or less. Unless you change the formatting. Etc... But I mean by default).

if you've tried both things mentioned in the help, an yet still have problems, post your SPL and both the results you get, but also the results you'd expect to have. And a few events from the results of the search (without subsearch) and the subsearch (run independently from the search).

Re: Using values from search into subsearch

nvanderwalt_spl — Sun, 30 Jun 2019 23:43:40 GMT

You probably need something along these lines (adjust fields and indexes as needed)

 index=auth type=login [search index=auth type=failed  earliest=-4h |stats count by user |fields user]