topic subsearch from previous results in Splunk Search

subsearch from previous results

bijodev1 — Thu, 03 Feb 2022 07:06:59 GMT

I need to run three different queries based on the each respective results.

for example :

1) In the first one query : index * search | top result.

so let's say I pick the first result which is "abc"

2) In second query I use the first result and inject it in here

index=* search result=abc | top status

3) Use the second result and inject it in the third search

index=* search result=abc status=xyz | timechart count by "something"

I am not sure if there is easier way to do it or this would take more time and bandwidth. Any help would be really helpful. Need some guidance here.

ITWhisperer — Thu, 03 Feb 2022 07:31:38 GMT

Subsearches are execute first so try nesting the searches like this

bijodev1 — Thu, 03 Feb 2022 13:56:32 GMT

thank you @ITWhisperer it worked as expected.