Splunk Search

Query Help

gozdeyildiz
New Member

Hi,

I am trying to search logs from specific source and with specific name and to search IP found in previous search in all indexes.

Ex: index=firewall and name="malicious IP' (this will give a log with IP address and I want to search that IP address in all indexes.

Thanks in advance.
Bests,
Gozde

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @gozdeyildiz,
please try something like this (if the field is called IP in every index:

index=* [ search index=firewall name="malicious IP" | fields IP ]
| ...

If you cannot be sure that IP field has the same name in every index, you could try something like this:

index=* [ search index=firewall name="malicious IP" | rename IP AS query | fields query ]
| ...

In both the searches check if the number of results of subsearch is more or less than 50,000, because there's this limit in subsearches.

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...