Looping in SPLUNK Query

[Janani_Krish]

Hello,

I have a table of IP's and my requirement is to fetch raw data for all the IP's from each and every sourcetype having the IP.

My query is like below,

1.sourcetype="IPs"|dedup ip|table ip

So I want to use below logic,

For each and every IP in the table, run the below query,

2.sourcetype!="IPs"|table sourcetype,_raw

Help me to run the second query for each and every IP in 1st query and merge the tables.

[thambisetty]

there could be many events in a single sourcetype that matches one particular IP, this will create search performance issue and it may take hours/days if you are searching in GBs of data. 

sourcetype!="IPs" 
    [ search sourcetype="IPs" 
    | stats count by IP 
    | table IP 
    | rename IP as search 
    | format] 
| table sourcetype,_raw

The reason for not using IP field in sub search is because your other source types may not have have field IP as I can see you provided only table sourcetype, _raw. The above search will do basic search with just IPs rather than IP and IP_value. we can't group the sourcetype and _raw by IP because IP field could be different in different sourcetypes, if you think IP field is present in all source types, you can add below to the search.

| stats values(sourcetype) as sourcetype values(_raw) as _raw by IP

give a thumps up if my answer gives a clue.

[ITWhisperer]

Have you tried the join command to link the two queries by ip?

[Janani_Krish]

Hi @ITWhisperer , 

I cannot use join because I do not have a single meta in my second sub query.

1.In my 1st part of query I have single sourcetpe which is IPs and meta as IP.

2.My second part of query has to search for the ip address in all sourcetype other than sourcetype=IPs.

So since Ip is captured in different metas in rest all sourcetype,this makes it difficult to use join command.

Eg: It is src_ip in sourcetype1, dst_ip in sourcetype 2 etc.,

[thambisetty]

can you explain your query with examples?

[Janani_Krish]

Hello @thambisetty ,

Currently I have my query in 2 parts.
1. sourcetype="IPs"|dedup IP|table IP
2. sourcetype!="IPs"|table sourcetype,_raw

Currently I have the data as below from 1st part of query.
128.0.0.9
234.56.78.98
45.76.89.98

I want these Ips to be mapped with its respective raw logs where the IP may or may not be captured in different/more than one sourcetype as below by combining the second part of query.

128.0.0.9          sourcetype 1 raw log
                             sourcetype 2 raw log
234.56.78.98  sourcetype 2 raw log
45.76.89.98    sourcetype 3 raw log
                             sourcetype n raw log