https://community.splunk.com/t5/Splunk-Search/How-to-use-a-table-as-input-for-a-new-search/m-p/464745#M130954 <PRE><CODE>index="my_index" sourcetype="my_sourcetype" earliest=-1h@h [ search index="my_index" sourcetype="my_sourcetype" earliest=-10h@h latest=-1h@h action="failed login" | stats count by username, action | where count &gt; 5 | table username ] </CODE></PRE> <P>The [subsearch] runs first, which produces the list of username which is fed to the main search. <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch#Example_2:_Search_with_a_subsearch">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch#Example_2:_Search_with_a_subsearch</A></P> Tue, 27 Aug 2019 20:37:03 GMT solarboyz1 2019-08-27T20:37:03Z https://community.splunk.com/t5/Splunk-Search/How-to-use-a-table-as-input-for-a-new-search/m-p/464744#M130953 <P>Hi all. I'm trying to write a search that will list users with more than 5 failed logins in the past 8 hours and then from that result, show those users that have had a failure in the past hour. I've got the first part working with this search:</P> <PRE><CODE>index="my_index" sourcetype="my_sourcetype" earliest=-10h@h action="failed login" | stats count by username, action | where count &gt; 5 | table username </CODE></PRE> <P>I now have a table with the usernames I want to run my secondary search for.<BR /><BR /> How do I take that table and run a new search against it? </P> <P>Thanks in advance.</P> Tue, 27 Aug 2019 20:18:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-a-table-as-input-for-a-new-search/m-p/464744#M130953 bobstoll 2019-08-27T20:18:33Z https://community.splunk.com/t5/Splunk-Search/How-to-use-a-table-as-input-for-a-new-search/m-p/464745#M130954 <PRE><CODE>index="my_index" sourcetype="my_sourcetype" earliest=-1h@h [ search index="my_index" sourcetype="my_sourcetype" earliest=-10h@h latest=-1h@h action="failed login" | stats count by username, action | where count &gt; 5 | table username ] </CODE></PRE> <P>The [subsearch] runs first, which produces the list of username which is fed to the main search. <BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch#Example_2:_Search_with_a_subsearch">https://docs.splunk.com/Documentation/Splunk/7.3.1/SearchTutorial/Useasubsearch#Example_2:_Search_with_a_subsearch</A></P> Tue, 27 Aug 2019 20:37:03 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-a-table-as-input-for-a-new-search/m-p/464745#M130954 solarboyz1 2019-08-27T20:37:03Z