Extract user list and use in next query

[MattQ]

I have a search that returns a number of UserNames. I would like to extract just the usernames [field:UserName] from the search results and then do a follow on search for all the items that have those usernames in them.

Search and return 'ListOfUsers'
Use 'ListOfUsers' to Search index=* (or separate broad search) to return ALL activity from 'ListOfUsers'

[alacercogitatus · Accepted solution]

Sure.

index=* [ search your_search_for_users | table UserName ] | do_other_things

But.... subsearches are inefficient, since they consume 2 cpus per execution. A nicer way would be to keep a lookup of users, and then use the lookup in the search.

The Saved Search that runs every so often:

index=whatever find_your_users | table UserName | outputlookup interesting_users.csv

Then use it in a "sub-searchy" kind of way.

index=* other_criteria [ | inputlookup interesting_users.csv | table UserName ]

[David]

This is a great use case for a subsearch. You would have your entire search be:

[search <search criteria for the list of users> | fields UserName] <search for activities>

The subsearch will output a series usernames that are then criteria for the broader search. Make sure you start your subsearch with "search."

[MattQ]

That works to input a field into a more limited search. Is there a way to port those results into a wider search. Like back into index=* UserNameList