Getting Data In

Recursive query based upon current result set


Having some trouble figuring this out, and fishing for an example as well.

Have an index that contains URL traffic logs. The category of these logs is dynamically updated each day.

index=url_logs category=malware | table user category url --> i get my results if there's any hits

But i what I'd like to do is to search for anything that currently matches malware on today's date with a search going back at least a week. That way I could tell if there was a lot of allowed traffic to a site that is now malicious and investigate from there.

Any suggestions? Thank you!

Tags (1)
0 Karma


index=url_logs url=* | stats values(user), values(url) by category | where category=malware

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...