https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161007#M45555 <P>You need the <CODE>map</CODE> command, like this:</P> <PRE><CODE>first search that generates a list of events that have the "_time" values you need | map search = "search earliest&gt;(_time-60) latest&lt;(time+60) some other search" </CODE></PRE> <P>You can also use the <CODE>FOREACH</CODE> command.</P> Thu, 18 Jun 2015 13:10:01 GMT woodcock 2015-06-18T13:10:01Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161006#M45554 <P>I am getting output for max hits at particular date and hour for a 1st search having <CODE>index=iis</CODE>. Now i want the date and hour from the 1st search to be input for 2nd search to find result for <CODE>index=perfmon</CODE> and show output fields of both searches.</P> <P>Is it possible?</P> Thu, 18 Jun 2015 12:51:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161006#M45554 shreyasathavale 2015-06-18T12:51:59Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161007#M45555 <P>You need the <CODE>map</CODE> command, like this:</P> <PRE><CODE>first search that generates a list of events that have the "_time" values you need | map search = "search earliest&gt;(_time-60) latest&lt;(time+60) some other search" </CODE></PRE> <P>You can also use the <CODE>FOREACH</CODE> command.</P> Thu, 18 Jun 2015 13:10:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161007#M45555 woodcock 2015-06-18T13:10:01Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161008#M45556 <P>I am trying this..Meanwhile could you please tell if it is possible:</P> <P>1st query output:<BR /> date_hour date_mday<BR /> 4 15</P> <P>2nd query output using hour and day of 1st query ouput<BR /> host counter avg(Value)<BR /> 1552 % Processor Time 20.611920</P> <P>I want<BR /> date_hour date_mday host counter avg(Value)<BR /> 4 15 ms.. .... ...</P> Mon, 28 Sep 2020 20:17:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161008#M45556 shreyasathavale 2020-09-28T20:17:10Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161009#M45557 <P>OK, I think you are asking for something different than is implied by your original text. It sounds like you are trying to do a <CODE>join</CODE> (merge) by <CODE>host</CODE>. If so, try this:</P> <PRE><CODE>(first query here | eval datehour=date_hour | eval datemday=date_mday) OR (second query here) | stats avg(Value) values(counter) AS counter values(datehour) AS datehour values(datemday) AS datemday by host </CODE></PRE> Thu, 18 Jun 2015 14:16:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-result-from-an-index-of-the-1st-search-as-input/m-p/161009#M45557 woodcock 2015-06-18T14:16:48Z