How to save Splunk search output as report then use it as dynamic lookup in the next search?

[lisav2021]

Dear Experts:

I'm new to Splunk. I have a search output device lists with events number greater than 20 as a report, for example,

event_date      src                              events

2021-02-08	device1	102
2021-02-08	device2	20

I need to have a new search to look into the event details on each of the device on the list to create final report and alerts if applicable. The report has to be dynamic as part of my search each time as scheduled task hourly, cannot be a static csv file as Lookup. Please advise strategies and code. Thank you. Lisa

[richgalloway · Accepted solution]

Thanks to those details we can say you don't need a lookup file after all.  Use a subsearch to collect the device names for use in the main search.  Like this:

index=blue-es-win_ad EventCode=4625 src IN [search stuff | rename device as src | format ] 

[lisav2021]

Thank you for your help! It worked!

[lisav2021]

Typo correction: index=blue-es-win_ad EventCode=4625 src IN inputlookup multi_user_failure_on_devices.csv

failed.

[lisav2021]

Thank you. I use outputlookup multi_user_failure_on_devices.csv. How can I use another search to use the csv file?

index=blue-es-win_ad EventCode=4625 src IN inputlookup customers.csv

Failed. How do I reference the csv file result where src= device1, or device2 cases?

Looking forward to hearing form you. Thank you.

[richgalloway]

Have the first search save its output to a lookup file using the outputlookup command.  Then the second search can read that data using inputlookup.  You're using a lookup file, but the data still is dynamic.

There may be other methods, too (perhaps using a subsearch), but we'd need to know more about the searches to be sure.