https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582193#M202800 <P>Thanks a lot , i am able to view the results of the&nbsp; user&nbsp; , but i am not able to see a statistics table sorted by the user with the highest&nbsp; count&nbsp; , please can you let me know if it is possible to display the table&nbsp;</P><P>Also is it possible to generate a CSV file for each individual user with the highest count ( higher than 100)&nbsp; as part of an alert or as a report&nbsp;</P> Mon, 24 Jan 2022 04:13:28 GMT Itsecuser1 2022-01-24T04:13:28Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582174#M202794 <P>index=logs&nbsp; appname="nameofapp " url=somewebsitenamestring&nbsp; &nbsp; &nbsp;|&nbsp; stats count by user | sort - count | where count &gt; 100</P><P>I would get results of 5 users and i want to initiate a different search using the results ,&nbsp; can you let me know how i can do it&nbsp;</P><P>index=logs&nbsp; &nbsp;appname="appname&nbsp; " user="here i need those 5 user names&nbsp; found in the results to be inserted&nbsp; &nbsp;"&nbsp; &nbsp; url=*somewebsitenamestring&nbsp; &nbsp;|&nbsp;&nbsp;&nbsp;table _time user url&nbsp;&nbsp;<BR /><BR /></P><P>I would prefer to receive 5 individual csv files for each user rather than one file with all 5 user data.</P><P>&nbsp;</P><P>Thanks for your help , please let me know if this is possible&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P> Sun, 23 Jan 2022 10:46:11 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582174#M202794 Itsecuser1 2022-01-23T10:46:11Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582183#M202798 <LI-CODE lang="markup">index=logs appname="appname url=*somewebsitenamestring [ search index=logs appname="nameofapp " url=somewebsitenamestring | stats count by user | where count &gt; 100 | table user ] | table _time user url </LI-CODE> Sun, 23 Jan 2022 14:15:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582183#M202798 ITWhisperer 2022-01-23T14:15:43Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582193#M202800 <P>Thanks a lot , i am able to view the results of the&nbsp; user&nbsp; , but i am not able to see a statistics table sorted by the user with the highest&nbsp; count&nbsp; , please can you let me know if it is possible to display the table&nbsp;</P><P>Also is it possible to generate a CSV file for each individual user with the highest count ( higher than 100)&nbsp; as part of an alert or as a report&nbsp;</P> Mon, 24 Jan 2022 04:13:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582193#M202800 Itsecuser1 2022-01-24T04:13:28Z https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582200#M202803 <LI-CODE lang="markup">index=logs appname="appname url=*somewebsitenamestring [ search index=logs appname="nameofapp " url=somewebsitenamestring | stats count by user | where count &gt; 100 | table user ] | eventstats count by user | sort -count | table _time user url count</LI-CODE><P>I don't think you can generate a csv file for each user, you can generate a csv file but it would contain all the results.</P> Mon, 24 Jan 2022 06:57:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-automatically-initiate-second-search-using-the-results-of/m-p/582200#M202803 ITWhisperer 2022-01-24T06:57:54Z