https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-a-file-and-then-use-the-name-of-that-file/m-p/350797#M163224 <P>I have a collection of hundreds of files. I want to write a search that (1) finds which file has a certain keyword and then (2) search that particular file for additional content for tabling.</P> <P>Searching for the specific file is done as follows ...</P> <P>source="jobs/*" "load = 1234" | dedup source</P> <P>... but I have been googling/trying to figure out how to use that source to drive the next part of the query. Here is some pseudocode with source renamed for ?clarity? as so far I have not been able to find a good way.</P> <P>source="jobs/*" "load = 1234" | dedup source | rename source as XX | search source=XX "mysearchstring"</P> Wed, 31 Jan 2018 03:09:01 GMT dmoulais 2018-01-31T03:09:01Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-a-file-and-then-use-the-name-of-that-file/m-p/350797#M163224 <P>I have a collection of hundreds of files. I want to write a search that (1) finds which file has a certain keyword and then (2) search that particular file for additional content for tabling.</P> <P>Searching for the specific file is done as follows ...</P> <P>source="jobs/*" "load = 1234" | dedup source</P> <P>... but I have been googling/trying to figure out how to use that source to drive the next part of the query. Here is some pseudocode with source renamed for ?clarity? as so far I have not been able to find a good way.</P> <P>source="jobs/*" "load = 1234" | dedup source | rename source as XX | search source=XX "mysearchstring"</P> Wed, 31 Jan 2018 03:09:01 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-a-file-and-then-use-the-name-of-that-file/m-p/350797#M163224 dmoulais 2018-01-31T03:09:01Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-a-file-and-then-use-the-name-of-that-file/m-p/350798#M163225 <P>Think you want to use a subsearch:</P> <PRE><CODE>"mysearchstring" [ search source="jobs/*" "load = 1234" | dedup source | table source ] </CODE></PRE> <P><A href="https://docs.splunk.com/Documentation/Splunk/7.0.1/SearchTutorial/Useasubsearch">SubSearch doc</A></P> Wed, 31 Jan 2018 13:47:49 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-a-file-and-then-use-the-name-of-that-file/m-p/350798#M163225 teunlaan 2018-01-31T13:47:49Z