Dashboard: Using the values of a previous search in another search

[Kate_Lawrence-G]

I have a list of MAC addresses that indicate a unit is in production and a subsequent Perl script that pulls 10 at random every 10 minutes and populates a CSV that splunk has configured as a lookup. I then join that MAC to a subsearch to get the current IP address that corresponds to those random MAC addresses to get the current activity over 24 hours.

|inputlookup top10.csv | join mac [search source=stuff] | stats values(mac) by ipaddress

This works fine and is integrated in my dashboard as a simple results table.

The question is how can I use the returned value of the ipaddress field in a new or postprocess search?

Thanks!

[gkanapathy]

First of all, your search would be much better as:

source=stuff 
[ inputlookup top10.csv 
  | fields mac ] 
| stats values(mac) by ipaddress

Second we then re-use this version in a nested subsearch to answer your original question:

source=mysecondsetofdata 
[ source=stuff 
  [ inputlookup top10.csv 
    | fields mac ] 
  | stats values(mac) by ipaddress ] 
| fields ipaddress ]

This would search mysecondsetofdata for any events that had a field ipaddress where it equaled one of the values of ipaddress returned by the outer subsearch.

[Kate_Lawrence-G]

Thanks! That's it! I think I was getting caught up on that join....