topic Re: Can I run another search based on the results of a previous search? in Splunk Search

Can I run another search based on the results of a previous search?

mbenitezr — Thu, 19 Mar 2015 17:46:07 GMT

I want to search the command "kill" on source bash_command=kill* and search the process from sourcetype=ps

Thanks a lot.

Re: Can I run another search based on the results of a previous search?

bandit — Thu, 19 Mar 2015 18:31:32 GMT

I think this post may help you.

http://answers.splunk.com/answers/89845/filter-search-results-based-on-return-value-of-subsearch.html

Re: Can I run another search based on the results of a previous search?

masonmorales — Thu, 19 Mar 2015 20:14:34 GMT

Yes, you would use a subsearch. The subsearch is evaluated first, and is treated as a boolean AND to your base search.

Example:

sourcetype=ps [search bash_command=kill* | fields ps]

Re: Can I run another search based on the results of a previous search?

mbenitezr — Mon, 28 Sep 2020 19:20:16 GMT

hello again,

I have this:

(sourcetype=ps) | search [search bash_command=kill* | rex field=bash_command "kill (?.+[0-9])" | dedup PID |fields PID ]

But don't work, i now i need split PID, but, i want first somo data

thanks a lot to rob_jordan and masonmorales

Re: Can I run another search based on the results of a previous search?

masonmorales — Tue, 24 Mar 2015 18:51:47 GMT

Glad it worked out. Could you click "Accept Answer" please?

Re: Can I run another search based on the results of a previous search?

mbenitezr — Tue, 24 Mar 2015 19:37:06 GMT

it is not working well, i want to search the process was killed in typesouce ps, but i can't do it

Re: Can I run another search based on the results of a previous search?

masonmorales — Tue, 24 Mar 2015 20:57:45 GMT

Could you post sample data from each source please?

Re: Can I run another search based on the results of a previous search?

bandit — Wed, 25 Mar 2015 16:09:53 GMT

Note: the the subsearch (child search) will append PID=### to the primary (parent search) where ### is the PID digits. If the parent search does not know what the field PID is, it won't work. I made some minor tweaks to the regex. Also typesource should be "sourcetype".

sourcetype=ps [ search bash_command=kill* | rex field=bash_command "kill\s+(?<PID>\d+)" | dedup PID | fields PID ]

you could do a manual test of the primary search by hard coding the PID you are looking for as a test. If the manual test doesn't work, then the dynamic sub search won't work.

i.e.

sourcetype=ps PID="###"

Alternate search which will just search for the PID as a string instead of as a field. Might result in false positive matches.

sourcetype=ps [ search bash_command=kill* | rex field=bash_command "kill\s+(?<PID>\d+)" | dedup PID | fields PID | rename PID as search ]

More or less equivalent to a manual search of

sourcetype=ps "###"

Re: Can I run another search based on the results of a previous search?

mbenitezr — Fri, 27 Mar 2015 22:10:23 GMT

you just have change typesource for sourcetype

Re: Can I run another search based on the results of a previous search?

mbenitezr — Fri, 27 Mar 2015 22:10:37 GMT

thanks a lot

Re: Can I run another search based on the results of a previous search?

masonmorales — Fri, 27 Mar 2015 23:15:12 GMT

Yes, sorry, I thought "typesource" was a field extraction that you had. If your sourcetype is called "ps" then it is "sourcetype=ps [search bash_command=kill* | fields ps]"

My apologies for any confusion that may have caused.