Dashboards & Visualizations

Dashboard: Using the values of a previous search in another search

Kate_Lawrence-G
Contributor

I have a list of MAC addresses that indicate a unit is in production and a subsequent Perl script that pulls 10 at random every 10 minutes and populates a CSV that splunk has configured as a lookup. I then join that MAC to a subsearch to get the current IP address that corresponds to those random MAC addresses to get the current activity over 24 hours.

|inputlookup top10.csv | join mac [search source=stuff] | stats values(mac) by ipaddress

This works fine and is integrated in my dashboard as a simple results table.

The question is how can I use the returned value of the ipaddress field in a new or postprocess search?

Thanks!

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

First of all, your search would be much better as:

source=stuff 
[ inputlookup top10.csv 
  | fields mac ] 
| stats values(mac) by ipaddress

Second we then re-use this version in a nested subsearch to answer your original question:

source=mysecondsetofdata 
[ source=stuff 
  [ inputlookup top10.csv 
    | fields mac ] 
  | stats values(mac) by ipaddress ] 
| fields ipaddress ]

This would search mysecondsetofdata for any events that had a field ipaddress where it equaled one of the values of ipaddress returned by the outer subsearch.

Kate_Lawrence-G
Contributor

Thanks! That's it! I think I was getting caught up on that join....

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...