https://community.splunk.com/t5/Splunk-Search/Subsearch-display-all-raw-data-that-lead-up-to-the-final-result/m-p/64875#M16027 <P>I think you just need to add something like this (assuming 3 the categories you list directly map to <CODE>sourcetype</CODE><span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <PRE><CODE>... | stats list(_raw) by username,sourcetype </CODE></PRE> Wed, 03 Jun 2015 17:06:58 GMT woodcock 2015-06-03T17:06:58Z https://community.splunk.com/t5/Splunk-Search/Subsearch-display-all-raw-data-that-lead-up-to-the-final-result/m-p/64874#M16026 <P>I am trying to find a way to have a subsearch display all the raw data that leads up to the final result. In my instance I am searching for DMCA violations and I search across our firewall for the NAT translation, then our DHCP scope for the MAC address and finally out authentication server for the username. For documentation purposes I need to have all the raw logs that lead up to the username.</P> <P>Below is my current subsearch: [search sourcetype=dhcpd [search sourcetype="netscreen:firewall" ip=$SrcIP$ port=$Port$ | top limit=5 src | fields + src | rename src as search] | top limit=5 src_mac | fields + src_mac | rename src_mac as search] sourcetype="cisco_acs" | top User_Name limit="5"</P> <P>Ideally I would like a report that shows something like</P> <P>Username: xyz</P> <P>NAT Translation: raw logs</P> <P>DHCP: raw logs</P> <P>Auth: raw logs</P> Tue, 22 Mar 2011 22:44:09 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-display-all-raw-data-that-lead-up-to-the-final-result/m-p/64874#M16026 clarkjk 2011-03-22T22:44:09Z https://community.splunk.com/t5/Splunk-Search/Subsearch-display-all-raw-data-that-lead-up-to-the-final-result/m-p/64875#M16027 <P>I think you just need to add something like this (assuming 3 the categories you list directly map to <CODE>sourcetype</CODE><span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <PRE><CODE>... | stats list(_raw) by username,sourcetype </CODE></PRE> Wed, 03 Jun 2015 17:06:58 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-display-all-raw-data-that-lead-up-to-the-final-result/m-p/64875#M16027 woodcock 2015-06-03T17:06:58Z