https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465551#M131163 <P>You're looking for a way to persist some search results -- and then further filter them?</P> <P>There's a few mechanisms for that with Splunk.<BR /> I think one is the closest to what you're looking for:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob</A><BR /> See also:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing">https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing</A></P> <P>There's likely a few others that also would help.<BR /> Good luck.</P> Fri, 03 Apr 2020 16:24:36 GMT memarshall63 2020-04-03T16:24:36Z https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465548#M131160 <P>or do I have to run a whole new query?</P> Wed, 01 Apr 2020 16:54:02 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465548#M131160 koocies 2020-04-01T16:54:02Z https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465549#M131161 <P>Not much to go on here... Maybe you can provide some more details around what you've tried and what your current data set or query attempts are... </P> <P>Broadly you can look at these:</P> <P><A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Search">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Search</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Where">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchReference/Where</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch">https://docs.splunk.com/Documentation/Splunk/8.0.2/SearchTutorial/Useasubsearch</A></P> Wed, 01 Apr 2020 19:45:17 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465549#M131161 memarshall63 2020-04-01T19:45:17Z https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465550#M131162 <P>If I run a query I get results, then I look over my results. Sometimes I want to filter out certain things from my results. I'd rather filter out my results and to research the index. I don't need to go back to well, I've got what I need, but I just need to filter out a little.</P> Fri, 03 Apr 2020 15:59:48 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465550#M131162 koocies 2020-04-03T15:59:48Z https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465551#M131163 <P>You're looking for a way to persist some search results -- and then further filter them?</P> <P>There's a few mechanisms for that with Splunk.<BR /> I think one is the closest to what you're looking for:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob">https://docs.splunk.com/Documentation/Splunk/8.0.3/SearchReference/Loadjob</A><BR /> See also:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch">https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Savedsearch</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing">https://docs.splunk.com/Documentation/Splunk/8.0.2/Knowledge/Usesummaryindexing</A></P> <P>There's likely a few others that also would help.<BR /> Good luck.</P> Fri, 03 Apr 2020 16:24:36 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-run-a-query-on-my-results-from-a-previous-query/m-p/465551#M131163 memarshall63 2020-04-03T16:24:36Z