topic Re: How can I pass the results from one search as a field in another search? in Splunk Search

How can I pass the results from one search as a field in another search?

yuwtennis — Wed, 15 Jan 2014 07:06:18 GMT

Hi !

I would like to have help with search.

I would like to pass the results from one search

search xxxxx|xxxxx
result:

fieldA

a
b
c
d
e

to other search as
search field=a OR field=b OR field=c OR field=d OR field=e | xxxxx

Can this be done with append or do you need additional scripting?

Thanks,
Yu

Re: How can I pass the results from one search as a field in another search?

Ayn — Wed, 15 Jan 2014 07:54:44 GMT

Have a look at format. http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Format

You can do this by using a subsearch and calling format with custom parameters in order to alter the way the subsearch outputs its results.

[search ... | rename fieldA as field | fields field | format "(" "(" "OR" ")" "OR" ")"] | ...

Re: How can I pass the results from one search as a field in another search?

yuwtennis — Mon, 28 Sep 2020 15:39:33 GMT

Hi ayn.

I think I found more simpler way.
I would rather use join type=inner join

This is part of actual search.

Re: How can I pass the results from one search as a field in another search?

Ayn — Wed, 15 Jan 2014 13:12:57 GMT

That's simpler? o_O

Re: How can I pass the results from one search as a field in another search?

yuwtennis — Fri, 17 Jan 2014 02:23:41 GMT

Well I have to bit amend my words.

Since the parameters I am passing to the next search will be the results from the stats. Which means I can not use the fixed search commands , like format "(" "(" "OR" ")" "OR" ")"] .

So I thought I needed to use the join to merge the results.

Re: How can I pass the results from one search as a field in another search?

sideview — Fri, 17 Jan 2014 04:14:15 GMT

definitely don't use join here. Also if you omit the format command from a subsearch entirely, splunk will sneak one in, and it'll be one with those exact same arguments. So you can simplify Ayn's answer by removing that format command entirely.

Also I'm not sure what your intention is with stats count(eval(diffSeq>0)) but since you're only using the distinct values anyway at the end, it's looks completely equivalent to

* [search index=test1_it OR index=test2_it 
earliest="11/1/2013:0:0:0" latest="12/1/2013:0:0:0"
| dedup fieldA
| fields fieldA ]

Re: How can I pass the results from one search as a field in another search?

yuwtennis — Mon, 20 Jan 2014 02:02:55 GMT

Hello sideview.

Thank you for the comment.
The stats command is just the filter for which record should I remain in use.

I will look into the format command.

Re: How can I pass the results from one search as a field in another search?

yuwtennis — Mon, 20 Jan 2014 02:06:49 GMT

Sideview

Do you mind if I ask the reason why should I not use the join command?

Re: How can I pass the results from one search as a field in another search?

yuwtennis — Mon, 20 Jan 2014 02:40:57 GMT

Hello ayn and sideview.

This solution was what I was looking for!

Thank you very much!