Splunk Enterprise Security

Passing fields into multiple searches w/out using Map Cmd

McThunderStick
Engager

*I would typically use the map command for this, but it's currently broken and support is working to fix it

That being said, I'm trying to take a value from search1, pass it to search2 , grab  a field from that 2nd search, and also pass that to 3rd search. Hopefully one of you lovely people can point me in the right direction.

IE:

index=foo | rex field field1

index=boo field2=$field1$ | table src_ip

index=bar src_ip=$src_ip$ | stats  values(domain) etc etc

 

Any help on this would be supremely appreciated

Labels (1)
Tags (2)
0 Karma

to4kawa
SplunkTrust
SplunkTrust

index=foo OR index=boo OR  index=bar | rex field field2|eventstats dc(index) as flag1 by field2 |  stats  values(domain) etc etc dc(index) as flag values(flag1) as flag1 by src_ip |where flag1=2 AND flag > 1

0 Karma

richgalloway
SplunkTrust
SplunkTrust

It looks like subsearches may do the job.

index=bar 
  [ index=boo 
    [index=foo | rex field field1 | rename field1 as field2 | format]
  | return src_ip ]
| stats  values(domain) etc etc
---
If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!