https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-output-from-one-serch-as-input-to-another/m-p/30240#M177999 <P>I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.<BR /> How can I do this in one step within Splunk?</P> Sun, 11 Nov 2012 19:40:52 GMT pgunn 2012-11-11T19:40:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-output-from-one-serch-as-input-to-another/m-p/30240#M177999 <P>I have a log file that comes from an email gateway (Ironmail). Each inbound message generates multple records within the log file. I need to be able to search for content in one of these records to obtain the common field in another record to retrive the results I need. Basically, using the output from one serch as input to another.<BR /> How can I do this in one step within Splunk?</P> Sun, 11 Nov 2012 19:40:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-output-from-one-serch-as-input-to-another/m-p/30240#M177999 pgunn 2012-11-11T19:40:52Z https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-output-from-one-serch-as-input-to-another/m-p/30241#M178000 <P>What you are looking for is a sub search.</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Useasubsearch" target="_blank">http://docs.splunk.com/Documentation/Splunk/5.0/Tutorial/Useasubsearch</A></P> <P>Your subsearch will obtain the fields from the ironmail log which is then used as fields that are sent to the outer search.</P> <P>example. index=other_index [search index=ironmail some_search_string | fields email_address ] </P> Mon, 28 Sep 2020 12:46:46 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-output-from-one-serch-as-input-to-another/m-p/30241#M178000 Lucas_K 2020-09-28T12:46:46Z https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-output-from-one-serch-as-input-to-another/m-p/30242#M178001 <P>Or, you could be speaking of a transaction. It depends on how you're trying to frame it, and the type of data you're dealing with. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0/Search/Identifyandgroupeventsintotransactions">http://docs.splunk.com/Documentation/Splunk/5.0/Search/Identifyandgroupeventsintotransactions</A></P> <P><A href="http://blogs.splunk.com/2012/11/05/book-excerpt-finding-specific-transactions/">http://blogs.splunk.com/2012/11/05/book-excerpt-finding-specific-transactions/</A></P> Sun, 11 Nov 2012 23:44:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-use-the-output-from-one-serch-as-input-to-another/m-p/30242#M178001 dwaddle 2012-11-11T23:44:11Z