topic Re: How to use output of a 1st query list as input in second query? in Splunk Search

How to use output of a 1st query list as input in second query?

agupta13 — Wed, 19 Oct 2022 01:55:11 GMT

I have an
```
index=xyz data.id=1
```
which gives me list of unique id's [1,2,3,4,5]Not sure how to store the above result to get it used for another query.

| stats count by uniqueId

Now I want to use the list above and get the data from another query and find the values
Query 2 will return
1 -> good
2 -> Bad
3 -> Neural / etc

Index2 I want to use the result [1,2,3,4] for the next query which will give me some extra information based on the ID only. Eg: Query 2 has index=xyz data.msg.id=1, data.xyz.val=good

How can we do that?

I am trying something like this

index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf" | table data.msg.id Find in second query the results of top [ search index="test" actionSubCateg="game" | rename data.DATA.id as id | fields id, scope | table id, scope]

Re: How to use output of a 1st query list as input in second query?

gcusello — Wed, 19 Oct 2022 06:06:13 GMT

Hi @agupta13,

the easiest solution is the jin command, but it's avery slow and not performant solution, so I hint a different approach like this:

(index="test" actionSubCateg IN (xyz) landingPageURL="xyz/?search=game_gupta" data.msg.queryName="query FindBtf") OR ([ search index="test" actionSubCateg="game") | eval id=if(actionSubCateg="game",'data.DATA.id', 'data.msg.id' | stats values(scope) AS scope values(data.xyz.val) AS val BY id

in this way you have a row for each id.

if you want you can take only the ids present in both searches adding a little condition

Ciao.

Giuseppe

Re: How to use output of a 1st query list as input in second query?

bowesmana — Wed, 19 Oct 2022 06:42:13 GMT

You can also use subsearches. If you want to limit the data from your second search to a list of ids generated in the first search, it's

search2 [ search1 | fields id ]

where the search 1 will do the stats count by uniqueid and make the returned field 'id' in the above case. In the search2, there should be an ID that will then match against the results of search 1.

You can see the effect of what search1 passes to search 2 by running search 1 standalone and adding

| format

to the end