https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640656#M221967 <P>I am not sure I understand - the subsearch with dedup and table essentially produces a list of users found in the subsearch e.g. ((user=="user1") OR (user=="user2")), which is added to the end of the initial search, thereby whitelisting the users from the main search. Is this not what you want to do?</P><P>(This is similar to</P><LI-CODE lang="markup">search ... [| inputlookup lookupfile.csv | dedup user | table user]</LI-CODE><P>which you may have seen elsewhere.)</P> Wed, 19 Apr 2023 17:03:54 GMT ITWhisperer 2023-04-19T17:03:54Z https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640650#M221964 <P>So there's ton of documentations of whitelisting through the subsearch approach using lookups, however, is it possible to whitelist using another search criteria within a search?</P><P>For example...</P><P>| search 1 index=blah1</P><P>[ sub search 2 index=blah2 ]</P><P>| if user in search 2 is in 1, whitelist<BR /><BR />Remember, I know how to whitelist through lookups. Just curious to know if there is another way.</P> Wed, 19 Apr 2023 16:43:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640650#M221964 Henesys 2023-04-19T16:43:34Z https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640653#M221965 <LI-CODE lang="markup">| search 1 index=blah1 [ sub search 2 index=blah2 | dedup user | table user]</LI-CODE> Wed, 19 Apr 2023 16:53:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640653#M221965 ITWhisperer 2023-04-19T16:53:05Z https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640654#M221966 <P>Not quite what I'm looking for. That would just simply output a table with user regardless if user from search 2 was in search 1.</P><P>&nbsp;</P><P>Is there anyway to make it so it can correlate or match and provide a new field saying matched between the two searches?</P> Wed, 19 Apr 2023 16:57:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640654#M221966 Henesys 2023-04-19T16:57:04Z https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640656#M221967 <P>I am not sure I understand - the subsearch with dedup and table essentially produces a list of users found in the subsearch e.g. ((user=="user1") OR (user=="user2")), which is added to the end of the initial search, thereby whitelisting the users from the main search. Is this not what you want to do?</P><P>(This is similar to</P><LI-CODE lang="markup">search ... [| inputlookup lookupfile.csv | dedup user | table user]</LI-CODE><P>which you may have seen elsewhere.)</P> Wed, 19 Apr 2023 17:03:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-whitelist-through-subsearching-with-out-lookups/m-p/640656#M221967 ITWhisperer 2023-04-19T17:03:54Z