topic Help for subsearch in Splunk Search

Help for subsearch

nebel — Fri, 13 Apr 2012 13:24:05 GMT

Hi Splunkers,

I need the result from first search in another search.

First search:
sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID

--> gives me for exmaple ID 13 back

At next I need this ID for figure out the location

Secound search:

sourcetype=win_server | multikv fields ID Location | search ID=$INPUT$ | table Location | dedup Location

Can anyone help me to bring them together?

Thanks a lot

Cheers

Re: Help for subsearch

MHibbin — Fri, 13 Apr 2012 13:35:42 GMT

I think you will need to use the subsearch (docs) field, "search" (shown in the subsearch docs), you should then be able to modify your search to the following:

sourcetype=win_server | multikv fields ID Location | search [search sourcetype=win_server | multikv fields ID Servername | search Servername=$INPUT$ | table ID | dedup ID | rename ID as search | fields + search] | table Location | dedup Location

Basically this should be equivalent to you typing ".. | search ID=13 |.." if you were to search the data manually. (additionally... the "query" performs a more generic search, i.e. "... | search 13 | ...").

Regards,

MHibbin

Re: Help for subsearch

nebel — Fri, 13 Apr 2012 13:46:42 GMT

thanks a lot. Worked great!

Re: Help for subsearch

MHibbin — Fri, 13 Apr 2012 13:49:25 GMT

nice one, have fun!