https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202389#M58703 <P>Hi mkatz,</P> <P>you can combine the searches and run it as one search by using the <CODE>filldown</CODE> command:</P> <PRE><CODE> host=hostname SSL=TLSv1.2 OR host=hostname2 RequestIP | filldown clientIP RequestIP | where clientIP=RequestIP | stats count by task </CODE></PRE> <P>This is un-tested since I don't have your events available, but should get you started.</P> <P>cheers, MuS</P> Wed, 28 Oct 2015 22:36:09 GMT MuS 2015-10-28T22:36:09Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202387#M58701 <P>I have a search that results in an IP address as the result with the field name <STRONG>clientIP</STRONG>:</P> <PRE><CODE>host=hostname SSL=TLSv1.2 | stats count by clientIP </CODE></PRE> <P>Now I want to take the results and use as a search using the same values for <STRONG>clientIP</STRONG>, renamed as <STRONG>RequestIP</STRONG>, such that I'm using the IP addresses from the initial result and using that to count addresses:</P> <PRE><CODE>host=hostname2 RequestIP | stats count by task </CODE></PRE> Wed, 28 Oct 2015 20:18:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202387#M58701 mkatz 2015-10-28T20:18:26Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202388#M58702 <P>You might want to try a subsearch to search based off the results of your previous search, there are some examples listed here</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchTutorial/Useasubsearch">http://docs.splunk.com/Documentation/Splunk/6.1.2/SearchTutorial/Useasubsearch</A></P> Wed, 28 Oct 2015 22:22:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202388#M58702 kserra_splunk 2015-10-28T22:22:30Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202389#M58703 <P>Hi mkatz,</P> <P>you can combine the searches and run it as one search by using the <CODE>filldown</CODE> command:</P> <PRE><CODE> host=hostname SSL=TLSv1.2 OR host=hostname2 RequestIP | filldown clientIP RequestIP | where clientIP=RequestIP | stats count by task </CODE></PRE> <P>This is un-tested since I don't have your events available, but should get you started.</P> <P>cheers, MuS</P> Wed, 28 Oct 2015 22:36:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202389#M58703 MuS 2015-10-28T22:36:09Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202390#M58704 <P>I don't think I explained it very well. I want to take the results of a search that gives me a list of IP addresses and use that list of IP addresses as part of the input for another search. In the first search the IP addresses is in the form of clientIP=IPAddress, but for the second search it needs to be RequestIP=IPAddress as the IPAddress has a different label in the second search.</P> Wed, 28 Oct 2015 23:05:48 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202390#M58704 mkatz 2015-10-28T23:05:48Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202391#M58705 <P>Can you provide one example each?</P> Wed, 28 Oct 2015 23:50:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202391#M58705 MuS 2015-10-28T23:50:40Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202392#M58706 <P>Try something like this</P> <PRE><CODE> host=hostname2 [search host=hostname SSL=TLSv1.2 | stats count by clientIP | table clientIP | rename clientIP as RequestIP ] | stats count by task </CODE></PRE> Thu, 29 Oct 2015 03:11:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202392#M58706 somesoni2 2015-10-29T03:11:42Z https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202393#M58707 <P>Just a side note on using <CODE>subsearches</CODE>, they have a hard limit - see docs for more details <A href="http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Aboutsubsearches">http://docs.splunk.com/Documentation/Splunk/6.3.0/Search/Aboutsubsearches</A> </P> Fri, 30 Oct 2015 18:48:31 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-the-output-from-one-search-as-input-for-another/m-p/202393#M58707 MuS 2015-10-30T18:48:31Z