topic How do I search within results of a search that has already run? in Splunk Search

How do I search within results of a search that has already run?

MonkeyK — Fri, 10 Nov 2017 20:41:46 GMT

Sometimes I write a brutal search that takes a very long time to run and then realize that I need to do something more to visualize it. Is there a way to just refer to the results of my already run search as input to the extra commands?

example
My manager tells me that I need to know all firewall traffic to a group of servers over the last year.

index=firewall dest_ip=192.168.100.0/24

I run this but it takes 30 hours to run. When I get the output, we see that a lot of the traffic is not interesting
now I would like to search on my original results to filter out the uninteresting traffic, something like:

 [get results from sid=1510343822.12851_69BC77DB-3AFA-433E-A86E-CFDBF93FB47D] 
| search NOT user in ["MonkeyA", "MonkeyB", "MonkeyC"] 
| stats count(bytes_in) by dest_ip

Is there a way to do this?

Re: How do I search within results of a search that has already run?

s2_splunk — Fri, 10 Nov 2017 21:27:44 GMT

You can use loadjob to retrieve your search results, if they haven't been reaped yet.

Re: How do I search within results of a search that has already run?

MonkeyK — Fri, 10 Nov 2017 21:55:59 GMT

Perfect! Thank you, this will save a lot of indexer and search head resources!

A couple of notes on this that I learned:

One can only loadjob for jobs that ran on the current searchhead. So logon to the running searchhead first.
To stop worrying about the search being reaped, one can output to a lookup table:

|loadjob 1510343822.12851_69BC77DB-3AFA-433E-A86E-CFDBF93FB47D | outputlookup myResults.csv

after that, just search the lookup

|inputlookup myResults.csv  
| search NOT user in ["MonkeyA", "MonkeyB", "MonkeyC"] 
| stats count(bytes_in) by dest_ip