topic How do I pull data from a subsearch? in Splunk Search

How do I pull data from a subsearch?

user12345a_2 — Wed, 11 Jan 2017 21:08:45 GMT

So I have the following search:
search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| table src_ip
which generates a list of IPs for which I need to search for username's against.

Normally, for a single IP (e.g. 192.168.0.1) I can run:
sourcetype=WinEventLog* 192.168.0.1 "EventCode=4624" | table src_ip, user|dedup src_ip, user
and I get a list of users that have logged into that system.

How do I use the results of the IP list from my first search to generate a table with IPs and usernames? I've been trying subsearches but to-date I've been unsuccessful.

Thank you in advance for the help.

Re: How do I pull data from a subsearch?

cmerriman — Wed, 11 Jan 2017 21:15:43 GMT

try this:

sourcetype=WinEventLog* "EventCode=4624" [search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| table src_ip|format]| stats count by src_ip, user|fields - count

Re: How do I pull data from a subsearch?

gokadroid — Wed, 11 Jan 2017 21:18:16 GMT

Can you try this below:

sourcetype=WinEventLog* "EventCode=4624" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"
[ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"| dedup src_ip| table src_ip ]
| table src_ip, user
|dedup src_ip, user

Re: How do I pull data from a subsearch?

twinspop — Wed, 11 Jan 2017 21:20:47 GMT

You really need to know the field name for the IP in the second search. The single field output from the first search needs to match that. Assuming you have a field named src_ip in the second set of logs:

[ search host="MY_IP_LIST" index="test" earliest="1/5/2017:00:00:01" latest="1/5/2017:13:00:00"
    | table src_ip
] sourcetype=WinEventLog* "EventCode=4624" 
| table src_ip, user
| dedup src_ip, user

This will essentially create a list of (src_ip=something OR src_ip=somethingelse ....) representing all your src_ips and insert that into your search string.